feat(volume-browser): phase 1 - path resolver & file system API

- Extract volume path resolution into shared internal/volume/resolver.go
- File browser operations: ListDir, OpenFile, WriteZip, SaveFile
- Strict path traversal protection (double-validated)
- API endpoints: browse, download (file or zip), upload (multipart)
- Refactor deployer to use shared resolver

internal/api/router.go

@@ -139,6 +139,8 @@ func (s *Server) Router() chi.Router {
 				r.Get("/stages/{stage}/instances", s.listInstances)
 				r.Get("/stages/{stage}/instances/{iid}/stats", s.getInstanceStats)
 				r.Get("/volumes", s.listVolumes)
+				r.Get("/volumes/{volId}/browse", s.browseVolume)
+				r.Get("/volumes/{volId}/download", s.downloadVolume)
 
 				// Admin-only project mutations.
 				r.Group(func(r chi.Router) {
@@ -169,6 +171,7 @@ func (s *Server) Router() chi.Router {
 					r.Post("/volumes", s.createVolume)
 					r.Put("/volumes/{volId}", s.updateVolume)
 					r.Delete("/volumes/{volId}", s.deleteVolume)
+					r.Post("/volumes/{volId}/upload", s.uploadToVolume)
 				})
 			})
 			r.Get("/deploys", s.listDeploys)