feat(docker-watcher): phase 13 - volumes & environment

Per-stage env var overrides with encryption for secrets.
Volume mounts with shared/isolated modes (isolated appends
/{stage}-{tag}/ to source path). Store CRUD, API endpoints,
and frontend editors for both. Env merge during deploy.

web/src/lib/api.ts

@@ -7,7 +7,9 @@ import type {
 	Project,
 	ProjectDetail,
 	Registry,
-	Settings
+	Settings,
+	StageEnv,
+	Volume
 } from './types';
 
 // ── Helpers ─────────────────────────────────────────────────────────
@@ -237,4 +239,63 @@ export function exportConfigUrl(): string {
 	return '/api/config/export';
 }
 
+// ── Stage Env Overrides ──────────────────────────────────────────────
+
+export function listStageEnv(projectId: string, stageId: string): Promise<StageEnv[]> {
+	return get<StageEnv[]>(`/api/projects/${projectId}/stages/${stageId}/env`);
+}
+
+export function createStageEnv(
+	projectId: string,
+	stageId: string,
+	data: { key: string; value: string; encrypted?: boolean }
+): Promise<StageEnv> {
+	return post<StageEnv>(`/api/projects/${projectId}/stages/${stageId}/env`, data);
+}
+
+export function updateStageEnv(
+	projectId: string,
+	stageId: string,
+	envId: string,
+	data: { key?: string; value?: string; encrypted?: boolean }
+): Promise<StageEnv> {
+	return put<StageEnv>(`/api/projects/${projectId}/stages/${stageId}/env/${envId}`, data);
+}
+
+export function deleteStageEnv(
+	projectId: string,
+	stageId: string,
+	envId: string
+): Promise<{ deleted: string }> {
+	return del<{ deleted: string }>(`/api/projects/${projectId}/stages/${stageId}/env/${envId}`);
+}
+
+// ── Volumes ──────────────────────────────────────────────────────────
+
+export function listVolumes(projectId: string): Promise<Volume[]> {
+	return get<Volume[]>(`/api/projects/${projectId}/volumes`);
+}
+
+export function createVolume(
+	projectId: string,
+	data: { source: string; target: string; mode?: string }
+): Promise<Volume> {
+	return post<Volume>(`/api/projects/${projectId}/volumes`, data);
+}
+
+export function updateVolume(
+	projectId: string,
+	volId: string,
+	data: { source?: string; target?: string; mode?: string }
+): Promise<Volume> {
+	return put<Volume>(`/api/projects/${projectId}/volumes/${volId}`, data);
+}
+
+export function deleteVolume(
+	projectId: string,
+	volId: string
+): Promise<{ deleted: string }> {
+	return del<{ deleted: string }>(`/api/projects/${projectId}/volumes/${volId}`);
+}
+
 export { ApiError };