feat(docker-watcher): phase 13 - volumes & environment

Per-stage env var overrides with encryption for secrets.
Volume mounts with shared/isolated modes (isolated appends
/{stage}-{tag}/ to source path). Store CRUD, API endpoints,
and frontend editors for both. Env merge during deploy.

web/src/routes/projects/[id]/+page.svelte

@@ -155,6 +155,22 @@
 			</button>
 		</div>
 
+		<!-- Project settings links -->
+		<div class="mt-4 flex gap-3">
+			<a
+				href="/projects/{projectId}/env"
+				class="rounded-md border border-gray-300 px-3 py-2 text-sm font-medium text-gray-700 hover:bg-gray-50"
+			>
+				Environment Variables
+			</a>
+			<a
+				href="/projects/{projectId}/volumes"
+				class="rounded-md border border-gray-300 px-3 py-2 text-sm font-medium text-gray-700 hover:bg-gray-50"
+			>
+				Volume Mounts
+			</a>
+		</div>
+
 		<!-- Project info -->
 		<div class="mt-6 grid grid-cols-2 gap-4 rounded-lg border border-gray-200 bg-white p-5 sm:grid-cols-4">
 			<div>