feat: persistent storage for Deno static sites

- Add storage_enabled and storage_limit_mb columns to static_sites.
- Create/attach Docker volumes (tinyforge-site-{name}-data) for Deno
  sites with storage enabled, mounted at /app/data.
- Grant --allow-write=/app/data in Deno container CMD.
- Add storage usage API endpoint (GET /api/sites/{id}/storage).
- Show storage section in site detail page with usage bar.
- Add storage toggle and limit field to new site wizard.
- Use ConfirmDialog for secret deletion instead of inline delete.

internal/docker/exec.go

@@ -0,0 +1,44 @@
+package docker
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/moby/moby/client"
+)
+
+// ExecInContainer runs a command inside a running container and returns the combined output.
+func (c *Client) ExecInContainer(ctx context.Context, containerID string, cmd []string) (string, error) {
+	exec, err := c.api.ExecCreate(ctx, containerID, client.ExecCreateOptions{
+		Cmd:          cmd,
+		AttachStdout: true,
+		AttachStderr: true,
+	})
+	if err != nil {
+		return "", fmt.Errorf("exec create: %w", err)
+	}
+
+	attach, err := c.api.ExecAttach(ctx, exec.ID, client.ExecAttachOptions{})
+	if err != nil {
+		return "", fmt.Errorf("exec attach: %w", err)
+	}
+	defer attach.Close()
+
+	var buf bytes.Buffer
+	if _, err := io.Copy(&buf, attach.Reader); err != nil {
+		return "", fmt.Errorf("exec read output: %w", err)
+	}
+
+	// Check exit code.
+	inspect, err := c.api.ExecInspect(ctx, exec.ID, client.ExecInspectOptions{})
+	if err != nil {
+		return buf.String(), nil // best effort — return output even if inspect fails
+	}
+	if inspect.ExitCode != 0 {
+		return "", fmt.Errorf("exec exited with code %d", inspect.ExitCode)
+	}
+
+	return buf.String(), nil
+}