feat(environments): env CRUD, workspace switcher, CLI + MCP parity (#68)

Environment lanes existed as seeded rows (production/preview/development)
with a per-service environment label, but there was no way to list,
create, or delete them. Adds the management surface and the switcher:

- GET /projects/:id/environments with live service counts (sqlc)
- POST /projects/:id/environments — lowercase dns-label names, 1-50
  chars, unique per project (409 on dupe)
- DELETE /environments/:id — refuses while it holds services (409)
- Workspace service list gains env filter chips with counts plus an
  inline "+ env" creator
- CLI: containr environments list|create|delete (--yes on delete);
  MCP: containr_environments_list/create/delete (delete needs confirm)
- OpenAPI: new Environments tag + ProjectEnvironment schema

Live-verified: list counts, name validation, dupe 409, empty delete,
non-empty 409, CLI list.

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/internal/api/routes.go

@@ -307,6 +307,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			read.GET("/projects", handleGetProjects)
 			read.GET("/projects/:id", handleGetProject)
 			read.GET("/projects/:id/services", handleGetServices)
+			read.GET("/projects/:id/environments", handleListEnvironments)
 			read.GET("/projects/:id/preview-environments", handleGetPreviewEnvironments)
 			read.GET("/projects/:id/security/history", securityHandler.GetProjectSecurityHistory)
 			read.GET("/projects/:id/vulnerabilities", securityHandler.GetVulnerabilities)
@@ -476,6 +477,8 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			authed.POST("/databases/:id/backups/import", databaseHandler.ImportBackup)
 			authed.GET("/databases/:id/backups/:bid/download", databaseHandler.DownloadBackup)
 
+			authed.POST("/projects/:id/environments", handleCreateEnvironment)
+			authed.DELETE("/environments/:id", handleDeleteEnvironment)
 			authed.POST("/projects/:id/preview-environments", handleCreatePreviewEnvironment)
 			authed.PUT("/preview-environments/:id", handleUpdatePreviewEnvironment)
 			authed.DELETE("/preview-environments/:id", handleDeletePreviewEnvironment)