feat: persistent storage for Deno static sites

- Add storage_enabled and storage_limit_mb columns to static_sites.
- Create/attach Docker volumes (tinyforge-site-{name}-data) for Deno
  sites with storage enabled, mounted at /app/data.
- Grant --allow-write=/app/data in Deno container CMD.
- Add storage usage API endpoint (GET /api/sites/{id}/storage).
- Show storage section in site detail page with usage bar.
- Add storage toggle and limit field to new site wizard.
- Use ConfirmDialog for secret deletion instead of inline delete.

internal/store/models.go

@@ -217,6 +217,8 @@ type StaticSite struct {
 	LastSyncAt     string `json:"last_sync_at"`
 	LastCommitSHA  string `json:"last_commit_sha"`
 	Error          string `json:"error"`
+	StorageEnabled bool   `json:"storage_enabled"`
+	StorageLimitMB int    `json:"storage_limit_mb"` // 0 = unlimited
 	CreatedAt      string `json:"created_at"`
 	UpdatedAt      string `json:"updated_at"`
 }

internal/store/static_sites.go

@@ -12,7 +12,7 @@ import (
 const staticSiteCols = `id, name, provider, gitea_url, repo_owner, repo_name, branch, folder_path,
 	access_token, domain, mode, render_markdown, sync_trigger, tag_pattern,
 	container_id, proxy_route_id, status, last_sync_at, last_commit_sha, error,
-	created_at, updated_at`
+	storage_enabled, storage_limit_mb, created_at, updated_at`
 
 // CreateStaticSite inserts a new static site and returns it.
 func (s *Store) CreateStaticSite(site StaticSite) (StaticSite, error) {
@@ -22,12 +22,13 @@ func (s *Store) CreateStaticSite(site StaticSite) (StaticSite, error) {
 
 	_, err := s.db.Exec(
 		`INSERT INTO static_sites (`+staticSiteCols+`)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		site.ID, site.Name, site.Provider, site.GiteaURL, site.RepoOwner, site.RepoName,
 		site.Branch, site.FolderPath, site.AccessToken, site.Domain, site.Mode,
 		BoolToInt(site.RenderMarkdown), site.SyncTrigger, site.TagPattern,
 		site.ContainerID, site.ProxyRouteID, site.Status, site.LastSyncAt,
-		site.LastCommitSHA, site.Error, site.CreatedAt, site.UpdatedAt,
+		site.LastCommitSHA, site.Error, BoolToInt(site.StorageEnabled), site.StorageLimitMB,
+		site.CreatedAt, site.UpdatedAt,
 	)
 	if err != nil {
 		return StaticSite{}, fmt.Errorf("insert static site: %w", err)
@@ -100,11 +101,12 @@ func (s *Store) UpdateStaticSite(site StaticSite) error {
 	result, err := s.db.Exec(
 		`UPDATE static_sites SET name=?, provider=?, gitea_url=?, repo_owner=?, repo_name=?, branch=?,
 		 folder_path=?, access_token=?, domain=?, mode=?, render_markdown=?,
-		 sync_trigger=?, tag_pattern=?, updated_at=?
+		 sync_trigger=?, tag_pattern=?, storage_enabled=?, storage_limit_mb=?, updated_at=?
 		 WHERE id=?`,
 		site.Name, site.Provider, site.GiteaURL, site.RepoOwner, site.RepoName, site.Branch,
 		site.FolderPath, site.AccessToken, site.Domain, site.Mode,
 		BoolToInt(site.RenderMarkdown), site.SyncTrigger, site.TagPattern,
+		BoolToInt(site.StorageEnabled), site.StorageLimitMB,
 		site.UpdatedAt, site.ID,
 	)
 	if err != nil {
@@ -168,35 +170,39 @@ func (s *Store) DeleteStaticSite(id string) error {
 // scanStaticSiteRow scans a static site from a *sql.Row.
 func scanStaticSiteRow(row *sql.Row) (StaticSite, error) {
 	var site StaticSite
-	var renderMarkdown int
+	var renderMarkdown, storageEnabled int
 	err := row.Scan(
 		&site.ID, &site.Name, &site.Provider, &site.GiteaURL, &site.RepoOwner, &site.RepoName,
 		&site.Branch, &site.FolderPath, &site.AccessToken, &site.Domain, &site.Mode,
 		&renderMarkdown, &site.SyncTrigger, &site.TagPattern,
 		&site.ContainerID, &site.ProxyRouteID, &site.Status, &site.LastSyncAt,
-		&site.LastCommitSHA, &site.Error, &site.CreatedAt, &site.UpdatedAt,
+		&site.LastCommitSHA, &site.Error, &storageEnabled, &site.StorageLimitMB,
+		&site.CreatedAt, &site.UpdatedAt,
 	)
 	if err != nil {
 		return StaticSite{}, err
 	}
 	site.RenderMarkdown = renderMarkdown != 0
+	site.StorageEnabled = storageEnabled != 0
 	return site, nil
 }
 
 // scanStaticSiteRows scans a static site from a *sql.Rows cursor.
 func scanStaticSiteRows(rows *sql.Rows) (StaticSite, error) {
 	var site StaticSite
-	var renderMarkdown int
+	var renderMarkdown, storageEnabled int
 	err := rows.Scan(
 		&site.ID, &site.Name, &site.Provider, &site.GiteaURL, &site.RepoOwner, &site.RepoName,
 		&site.Branch, &site.FolderPath, &site.AccessToken, &site.Domain, &site.Mode,
 		&renderMarkdown, &site.SyncTrigger, &site.TagPattern,
 		&site.ContainerID, &site.ProxyRouteID, &site.Status, &site.LastSyncAt,
-		&site.LastCommitSHA, &site.Error, &site.CreatedAt, &site.UpdatedAt,
+		&site.LastCommitSHA, &site.Error, &storageEnabled, &site.StorageLimitMB,
+		&site.CreatedAt, &site.UpdatedAt,
 	)
 	if err != nil {
 		return StaticSite{}, fmt.Errorf("scan static site: %w", err)
 	}
 	site.RenderMarkdown = renderMarkdown != 0
+	site.StorageEnabled = storageEnabled != 0
 	return site, nil
 }

internal/store/store.go

@@ -125,6 +125,9 @@ func (s *Store) runMigrations() error {
 		`ALTER TABLE settings ADD COLUMN image_prune_threshold_mb INTEGER NOT NULL DEFAULT 1024`,
 		// Add provider column to static_sites (2026-04-11).
 		`ALTER TABLE static_sites ADD COLUMN provider TEXT NOT NULL DEFAULT ''`,
+		// Add persistent storage columns to static_sites (2026-04-12).
+		`ALTER TABLE static_sites ADD COLUMN storage_enabled INTEGER NOT NULL DEFAULT 0`,
+		`ALTER TABLE static_sites ADD COLUMN storage_limit_mb INTEGER NOT NULL DEFAULT 0`,
 	}
 
 	for _, m := range migrations {