feat(services): volume mounts + admin volume inventory (C1)

services.volumes JSONB [{type: volume|bind, source, target, read_only}]
mapped into every replica's container config at deploy and reconcile
time, hashed into the runtime spec so mount changes trigger
reconciliation. Mounted via existing docker.HostConfig.Mounts.

- RuntimeSpec.Volumes + specHash + mount.Mount mapping in createReplica
- Create/update service accepts volumes; PUT replaces the whole list
- Replica-count reconcile now goes through the deploy queue — the last
  raw `go` reconcile left that could race a build
- GET /admin/volumes inventories node volumes with in_use flags;
  DELETE /admin/volumes/:name removes unused ones (409 on in-use)
- CLI: services update --volume/--bind/--clear-volumes, volumes
  list|delete; MCP: services_update + volumes_list/delete
- Settings UI: Volumes section with mount editor
- Migration normalizes the nullable baseline column to NOT NULL [].

Verified live: deploy applies mounts to the container, docker
auto-creates named volumes, in-use deletion is refused.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/api/openapi.yaml

@@ -1310,6 +1310,51 @@ paths:
                   message:
                     type: string
 
+  /admin/volumes:
+    get:
+      tags:
+        - Admin
+      summary: List docker volumes
+      description: Returns the node's docker volume inventory with in-use flags. Admin only.
+      security:
+        - bearerAuth: []
+      responses:
+        '200':
+          description: Volume list
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  volumes:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/VolumeInfo'
+
+  /admin/volumes/{name}:
+    delete:
+      tags:
+        - Admin
+      summary: Delete a docker volume
+      description: Removes an unused docker volume. Docker refuses in-use volumes — returned as 409.
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: name
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Volume deleted
+        '409':
+          description: Volume in use or removal failed
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+
   /templates/{id}:
     get:
       tags:
@@ -4953,6 +4998,11 @@ components:
         restart_policy:
           type: string
           description: Docker restart policy (default unless-stopped)
+        volumes:
+          type: array
+          items:
+            $ref: '#/components/schemas/ServiceVolume'
+          description: Volume/bind mounts applied to every replica
         public_url:
           type: string
           description: Computed public URL (published port or domain)
@@ -5023,6 +5073,11 @@ components:
         restart_policy:
           type: string
           description: Docker restart policy
+        volumes:
+          type: array
+          items:
+            $ref: '#/components/schemas/ServiceVolume'
+          description: Volume/bind mounts applied to every replica
 
     UpdateServiceRequest:
       type: object
@@ -5074,6 +5129,54 @@ components:
         restart_policy:
           type: string
           description: Docker restart policy
+        volumes:
+          type: array
+          items:
+            $ref: '#/components/schemas/ServiceVolume'
+          description: Replaces the entire mount list when present; [] clears all mounts. Takes effect on next deploy/reconcile.
+
+    ServiceVolume:
+      type: object
+      required:
+        - source
+        - target
+      properties:
+        type:
+          type: string
+          enum: [volume, bind]
+          default: volume
+          description: volume = docker named volume, bind = host path
+        source:
+          type: string
+          description: Volume name or host path
+        target:
+          type: string
+          description: Absolute container path
+        read_only:
+          type: boolean
+          default: false
+
+    VolumeInfo:
+      type: object
+      properties:
+        name:
+          type: string
+        driver:
+          type: string
+        mountpoint:
+          type: string
+        scope:
+          type: string
+        in_use:
+          type: boolean
+        used_by:
+          type: array
+          items:
+            type: string
+          description: Container names mounting this volume
+        created_at:
+          type: string
+          format: date-time
 
     Deployment:
       type: object

docs/guides/CLI.md

@@ -37,7 +37,8 @@ Resolution order for every command: `--token`/`--api-url` flags >
 auth login|logout|status         token auth and profiles
 tokens list|create|revoke        personal access tokens
 projects list|get|create|delete
-services list|get|create|delete|start|stop|restart|redeploy
+services list|get|create|update|delete|start|stop|restart|redeploy
+volumes list|delete              docker volume inventory + cleanup (admin)
 deploy <service-id>              trigger a deployment (--no-cache, --commit-hash, --branch)
 deployments list|get|logs|rollback|cancel
 logs <service-id> [--follow]     runtime logs (SSE follow)
@@ -70,6 +71,22 @@ containr up --project <id> --image ghcr.io/example/app:latest   # image, no buil
 Set `project_id` on the active profile to omit `--project` (stored in
 `~/.containr.yaml` under `profiles.<name>.project_id`).
 
+## Service volumes
+
+`services update` manages mounts; flags replace the whole mount list:
+
+```bash
+containr services update <id> --volume data:/data --bind /srv/cfg:/etc/app:ro
+containr services update <id> --clear-volumes
+```
+
+`type` is `volume` (docker named volume, auto-created) or `bind` (host
+path). `target` must be absolute. Mounts apply on the next deploy or
+redeploy — `containr deploy <id>` to apply immediately.
+
+`volumes list` shows the node's docker volume inventory with in-use
+flags; `volumes delete <name>` removes an unused volume (admin scope).
+
 ## MCP server
 
 `containr-mcp` (`go build ./cmd/mcp`) exposes the same API as MCP tools