feat(docker-watcher): phase 13 - volumes & environment

Per-stage env var overrides with encryption for secrets.
Volume mounts with shared/isolated modes (isolated appends
/{stage}-{tag}/ to source path). Store CRUD, API endpoints,
and frontend editors for both. Env merge during deploy.

internal/docker/container.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/go-connections/nat"
 )
@@ -46,6 +47,9 @@ type ContainerConfig struct {
 
 	// InstanceID is the docker-watcher instance ID (used for labelling).
 	InstanceID string
+
+	// Mounts is a list of bind mounts to attach to the container.
+	Mounts []mount.Mount
 }
 
 // sanitizeTag replaces characters that are invalid in Docker container names
@@ -94,6 +98,7 @@ func (c *Client) CreateContainer(ctx context.Context, cfg ContainerConfig) (stri
 	hostCfg := &container.HostConfig{
 		PortBindings:  portBindings,
 		RestartPolicy: container.RestartPolicy{Name: container.RestartPolicyDisabled},
+		Mounts:        cfg.Mounts,
 	}
 
 	// Attach to network at creation time if specified.