Per-stage env var overrides with encryption for secrets. Volume mounts with shared/isolated modes (isolated appends /{stage}-{tag}/ to source path). Store CRUD, API endpoints, and frontend editors for both. Env merge during deploy.
