feat(docker-watcher): phase 13 - volumes & environment

Per-stage env var overrides with encryption for secrets.
Volume mounts with shared/isolated modes (isolated appends
/{stage}-{tag}/ to source path). Store CRUD, API endpoints,
and frontend editors for both. Env merge during deploy.

internal/deployer/bluegreen.go

@@ -73,7 +73,8 @@ func (d *Deployer) blueGreenDeploy(
 	subdomain := d.buildSubdomain(project, stage, settings, imageTag)
 	containerName := docker.ContainerName(project.Name, stage.Name, imageTag)
 	portStr := fmt.Sprintf("%d/tcp", project.Port)
-	envVars := d.parseEnvVars(project.Env)
+	envVars := d.mergeEnvVars(project, stage.ID)
+	mounts := d.computeVolumeMounts(project.ID, stage.Name, imageTag)
 
 	containerCfg := docker.ContainerConfig{
 		Name:         containerName,
@@ -85,6 +86,7 @@ func (d *Deployer) blueGreenDeploy(
 		Project:      project.Name,
 		Stage:        stage.Name,
 		InstanceID:   instanceID,
+		Mounts:       mounts,
 	}
 
 	d.logDeploy(deployID, fmt.Sprintf("Blue-green: creating green container %s", containerName), "info")