feat: environment model + deployment tracking (phase 3a)

- Environment/Deployment XORM models + migration 010
- Full CRUD API: GET/POST/PATCH/DELETE /environments + /deployments
- Deployment status update endpoint, publishes deployment.* NATS events
- EnvironmentsPage with deploy cards, history accordion, deploy modal
- Sidebar Environments nav item between Pipelines and Settings
- Repo page deployment status badges (env name + SHA pill per
  environment)
- Environment/Deployment types in types/api.ts + environments.ts query
  hooks

internal/api/router.go

@@ -58,6 +58,7 @@ func New(cfg *config.Config, engine *xorm.Engine, store sessions.Store, bus even
 	auditH      := handlers.NewAuditHandler(engine)
 	artifactH   := handlers.NewArtifactHandler(engine, artifactRoot)
 	runnerH     := handlers.NewRunnerHandler(engine)
+	envH        := handlers.NewEnvironmentHandler(engine, bus)
 
 	// ── Git smart-HTTP transport ───────────────────────────────────────────────
 	// Regex constraint ensures only *.git paths match, so asset/SPA URLs
@@ -203,14 +204,28 @@ func New(cfg *config.Config, engine *xorm.Engine, store sessions.Store, bus even
 					})
 					r.Get("/default-description", prSettingsH.GetDefaultDescription)
 					r.With(csrf).Put("/default-description", prSettingsH.UpdateDefaultDescription)
-					r.Get("/excluded-files", prSettingsH.GetExcludedFiles)
-					r.With(csrf).Put("/excluded-files", prSettingsH.UpdateExcludedFiles)
-					r.Get("/lfs-settings", lfsH.Get)
-					r.With(csrf).Put("/lfs-settings", lfsH.Update)
+				r.Get("/excluded-files", prSettingsH.GetExcludedFiles)
+				r.With(csrf).Put("/excluded-files", prSettingsH.UpdateExcludedFiles)
+				r.Get("/lfs-settings", lfsH.Get)
+				r.With(csrf).Put("/lfs-settings", lfsH.Update)
+				r.Route("/environments", func(r chi.Router) {
+					r.Get("/", envH.ListEnvironments)
+					r.With(csrf).Post("/", envH.CreateEnvironment)
+					r.Route("/{envName}", func(r chi.Router) {
+						r.Get("/", envH.GetEnvironment)
+						r.With(csrf).Patch("/", envH.UpdateEnvironment)
+						r.With(csrf).Delete("/", envH.DeleteEnvironment)
+						r.Route("/deployments", func(r chi.Router) {
+							r.Get("/", envH.ListDeployments)
+							r.With(csrf).Post("/", envH.CreateDeployment)
+							r.With(csrf).Patch("/{deployID}/status", envH.UpdateDeploymentStatus)
+						})
+					})
 				})
 			})
 		})
 	})
+	})
 
 	r.With(auth.Optional).Get("/ws", wsH.Hub)