feat(vars): project shared variables — ${{shared.KEY}} refs, CRUD, UI

- project_variables table (secret entries encrypted at rest, masked in API)
- resolveServiceEnv resolves shared.* before service lookup
- GET|PUT /projects/{id}/variables; CLI 'variables shared list|set|unset';
  MCP containr_shared_variables_{list,set}
- Settings tab → Shared Variables editor; env help text mentions shared refs

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/migrations_goose/20261101000000_project_variables.sql

@@ -0,0 +1,19 @@
+-- +goose Up
+-- Project-level shared variables (Railway-style). Services reference them via
+-- ${{shared.KEY}} in environment values; secret entries are encrypted at rest
+-- and masked in API responses exactly like service variables.
+CREATE TABLE IF NOT EXISTS project_variables (
+    id uuid DEFAULT gen_random_uuid() NOT NULL PRIMARY KEY,
+    project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+    key varchar(255) NOT NULL,
+    value text NOT NULL DEFAULT '',
+    is_secret boolean NOT NULL DEFAULT false,
+    created_at timestamptz NOT NULL DEFAULT now(),
+    updated_at timestamptz NOT NULL DEFAULT now(),
+    UNIQUE (project_id, key)
+);
+
+CREATE INDEX IF NOT EXISTS idx_project_variables_project ON project_variables(project_id);
+
+-- +goose Down
+DROP TABLE IF EXISTS project_variables;