feat: environment model + deployment tracking (phase 3a)

- Environment/Deployment XORM models + migration 010
- Full CRUD API: GET/POST/PATCH/DELETE /environments + /deployments
- Deployment status update endpoint, publishes deployment.* NATS events
- EnvironmentsPage with deploy cards, history accordion, deploy modal
- Sidebar Environments nav item between Pipelines and Settings
- Repo page deployment status badges (env name + SHA pill per
  environment)
- Environment/Deployment types in types/api.ts + environments.ts query
  hooks

AGENTS.md

@@ -58,8 +58,8 @@ Understand the phases before adding code — don't build Phase 3 infrastructure
 | 1 | Auth, Git HTTP, repos, PRs, issues, RBAC, webhooks, LFS, design system, 20-page SPA | **Complete** |
 | 2A | NATS event bus, WebSocket hub upgrade, audit log | **Complete** |
 | 2B | CI orchestrator, runner manager, Docker executor, artifact registry | **Complete** |
-| 2C | Pipeline DAG visualization, dashboard CI upgrade, command palette wiring | **Active** |
-| 3A | Environment model + deployment tracking | Planned |
+| 2C | Pipeline DAG visualization, dashboard CI upgrade, command palette wiring | **Complete** |
+| 3A | Environment model + deployment tracking | **Active** |
 | 3B | Unified operational timeline | Planned |
 | 3C | Secret management hierarchy | Planned |
 | 3D | GitOps controller + drift detection | Planned |
@@ -69,18 +69,23 @@ Understand the phases before adding code — don't build Phase 3 infrastructure
 
 Do not implement Phase 3+ features without explicit discussion. The `domain/federation/` directory is an intentional stub — the data model exists but no HTTP handlers should be wired until Phase 3F.
 
-### Phase 2C — What's Left to Build
+### Phase 3A — What to Build
 
-All backend APIs for CI are complete. Phase 2C is entirely frontend work:
+Backend and frontend are both net-new for Phase 3A. Nothing exists yet.
 
-1. **`types/api.ts`** — `Pipeline` type uses stale fields (`ref`, `status`). Must be updated to match backend (`name`, `filePath`). Add `PipelineRun`, `PipelineJob`, `PipelineStep`, `PipelineStepLog` types.
-2. **`queries/pipelines.ts`** — Needs `useRuns`, `useRunDetail`, `useJobLogs`, cancel/retry mutations aligned with correct types.
-3. **`GET /api/v1/pipelines/runs`** — A new backend endpoint returning recent runs across all repos owned by the current user (needed by the global `/pipelines` page and dashboard widget).
-4. **`PipelinesPage`** — Currently an empty placeholder. Replace with real cross-repo runs list.
-5. **`PipelineRunPage`** — New page at `/repos/:owner/:repo/runs/:runId`. Shows run header + DAG + step log viewer.
-6. **`PipelineWaterfall`** — Currently uses mock data. Rewrite to accept real `PipelineJob[]` with `needs` dependency graph.
-7. **Dashboard CI widget** — Replace hardcoded "Pipeline integration coming soon." with live recent runs.
-8. **Command palette** — Add pipeline runs to search results.
+**Backend:**
+1. `internal/models/environment.go` — `Environment` (id, repoId, name, url, protectionRules JSON) + `Deployment` (id, envId, repoId, sha, ref, status, triggeredBy, description, runId, startedAt, finishedAt)
+2. `internal/models/migrations/010_environments.go` — `Run010()` syncing both structs; call from `001_init.go`
+3. `internal/api/handlers/environment.go` — `ListEnvironments`, `CreateEnvironment`, `GetEnvironment`, `UpdateEnvironment`, `DeleteEnvironment`, `ListDeployments`, `CreateDeployment`, `UpdateDeploymentStatus`; publish `deployment.*` NATS events
+4. `internal/api/router.go` — wire routes under `/{owner}/{repo}/environments` and `/{owner}/{repo}/environments/{envName}/deployments`
+
+**Frontend:**
+5. `frontend/src/types/api.ts` — add `Environment`, `Deployment`, `DeployStatus` types
+6. `frontend/src/api/queries/environments.ts` — `useEnvironments`, `useEnvironment`, `useCreateEnvironment`, `useUpdateEnvironment`, `useDeleteEnvironment`, `useDeployments`, `useCreateDeployment`, `useUpdateDeploymentStatus`
+7. `frontend/src/pages/EnvironmentsPage.tsx` — environment cards each showing latest deployment status, SHA, who deployed, time; "New environment" flow; deployment history per env
+8. `frontend/src/components/layout/Sidebar.tsx` — add `Environments` nav item between Pipelines and Settings in `RepoSubNav`
+9. `frontend/src/pages/RepoPage.tsx` — surface deployment status badges in the repo header (latest deploy per env at a glance)
+10. `frontend/src/App.tsx` — add route `repos/:owner/:repo/environments`
 
 ---