feat(docker-watcher): phase 1 - project scaffold & SQLite store

Initialize Go module, directory structure, and full SQLite store layer:
- 7-table schema (projects, stages, registries, settings, instances,
  deploys, deploy_logs) with auto-migration
- CRUD operations for all entities with proper error handling
- ErrNotFound sentinel for distinguishing 404 from 500 in handlers
- WAL mode, foreign keys, busy timeout pragmas

internal/store/settings.go

@@ -0,0 +1,37 @@
+package store
+
+import (
+	"fmt"
+)
+
+// GetSettings returns the global settings (single-row pattern, always row id=1).
+func (s *Store) GetSettings() (Settings, error) {
+	var st Settings
+	err := s.db.QueryRow(
+		`SELECT domain, server_ip, network, subdomain_pattern, notification_url,
+		        npm_url, npm_email, npm_password, webhook_secret, polling_interval, updated_at
+		 FROM settings WHERE id = 1`,
+	).Scan(&st.Domain, &st.ServerIP, &st.Network, &st.SubdomainPattern, &st.NotificationURL,
+		&st.NpmURL, &st.NpmEmail, &st.NpmPassword, &st.WebhookSecret, &st.PollingInterval, &st.UpdatedAt)
+	if err != nil {
+		return Settings{}, fmt.Errorf("query settings: %w", err)
+	}
+	return st, nil
+}
+
+// UpdateSettings upserts the global settings row.
+func (s *Store) UpdateSettings(st Settings) error {
+	st.UpdatedAt = now()
+	_, err := s.db.Exec(
+		`UPDATE settings SET
+			domain=?, server_ip=?, network=?, subdomain_pattern=?, notification_url=?,
+			npm_url=?, npm_email=?, npm_password=?, webhook_secret=?, polling_interval=?, updated_at=?
+		 WHERE id = 1`,
+		st.Domain, st.ServerIP, st.Network, st.SubdomainPattern, st.NotificationURL,
+		st.NpmURL, st.NpmEmail, st.NpmPassword, st.WebhookSecret, st.PollingInterval, st.UpdatedAt,
+	)
+	if err != nil {
+		return fmt.Errorf("update settings: %w", err)
+	}
+	return nil
+}