feat(docker-watcher): phase 13 - volumes & environment

Per-stage env var overrides with encryption for secrets.
Volume mounts with shared/isolated modes (isolated appends
/{stage}-{tag}/ to source path). Store CRUD, API endpoints,
and frontend editors for both. Env merge during deploy.

internal/store/models.go

@@ -91,3 +91,25 @@ type DeployLog struct {
 	Level     string `json:"level"` // info, warn, error
 	CreatedAt string `json:"created_at"`
 }
+
+// StageEnv represents a per-stage environment variable override.
+type StageEnv struct {
+	ID        string `json:"id"`
+	StageID   string `json:"stage_id"`
+	Key       string `json:"key"`
+	Value     string `json:"value"`
+	Encrypted bool   `json:"encrypted"`
+	CreatedAt string `json:"created_at"`
+	UpdatedAt string `json:"updated_at"`
+}
+
+// Volume represents a volume mount configuration for a project.
+type Volume struct {
+	ID        string `json:"id"`
+	ProjectID string `json:"project_id"`
+	Source    string `json:"source"`
+	Target   string `json:"target"`
+	Mode     string `json:"mode"` // shared or isolated
+	CreatedAt string `json:"created_at"`
+	UpdatedAt string `json:"updated_at"`
+}