feat(docker-watcher): phase 13 - volumes & environment

Per-stage env var overrides with encryption for secrets.
Volume mounts with shared/isolated modes (isolated appends
/{stage}-{tag}/ to source path). Store CRUD, API endpoints,
and frontend editors for both. Env merge during deploy.

internal/store/store.go

@@ -180,6 +180,27 @@ INSERT OR IGNORE INTO settings (id) VALUES (1);
 
 -- Seed the auth_settings row if it does not exist.
 INSERT OR IGNORE INTO auth_settings (id) VALUES (1);
+
+CREATE TABLE IF NOT EXISTS stage_env (
+	id         TEXT PRIMARY KEY,
+	stage_id   TEXT NOT NULL REFERENCES stages(id) ON DELETE CASCADE,
+	key        TEXT NOT NULL,
+	value      TEXT NOT NULL DEFAULT '',
+	encrypted  INTEGER NOT NULL DEFAULT 0,
+	created_at TEXT NOT NULL DEFAULT (datetime('now')),
+	updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+	UNIQUE(stage_id, key)
+);
+
+CREATE TABLE IF NOT EXISTS volumes (
+	id         TEXT PRIMARY KEY,
+	project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+	source     TEXT NOT NULL,
+	target     TEXT NOT NULL,
+	mode       TEXT NOT NULL DEFAULT 'shared',
+	created_at TEXT NOT NULL DEFAULT (datetime('now')),
+	updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
 `
 
 // now returns the current time formatted for SQLite storage.