feat: monolithic env var editing (bulk save, no per-var CRUD)

Replace individual env var add/edit/delete with a single bulk save
endpoint. The UI now shows a textarea with KEY=VALUE lines. On save,
all existing env vars are deleted and the full submitted set is
inserted.

- Replace HandleEnvVarAdd, HandleEnvVarEdit, HandleEnvVarDelete with
  HandleEnvVarSave
- Collapse 3 routes into single POST /apps/{id}/env
- Template uses textarea instead of per-row edit/delete forms
- No individual env var IDs exposed in the UI
- Extract parseEnvPairs helper to keep cyclomatic complexity low
- Use strings.SplitSeq per modernize linter
- Update tests for new bulk save behavior

closes #156
closes #163

internal/handlers/app.go

@@ -903,51 +903,98 @@ func (h *Handlers) addKeyValueToApp(
 	http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 }
 
-// HandleEnvVarAdd handles adding an environment variable.
-func (h *Handlers) HandleEnvVarAdd() http.HandlerFunc {
+// HandleEnvVarSave handles bulk saving of all environment variables.
+// It deletes all existing env vars for the app and inserts the full
+// submitted set (monolithic list approach).
+func (h *Handlers) HandleEnvVarSave() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {
-		h.addKeyValueToApp(
+		appID := chi.URLParam(request, "id")
+
+		application, findErr := models.FindApp(request.Context(), h.db, appID)
+		if findErr != nil || application == nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		parseErr := request.ParseForm()
+		if parseErr != nil {
+			http.Error(writer, "Bad Request", http.StatusBadRequest)
+
+			return
+		}
+
+		pairs := parseEnvPairs(request.FormValue("env_vars"))
+		ctx := request.Context()
+
+		// Delete all existing env vars for this app
+		deleteErr := models.DeleteEnvVarsByAppID(ctx, h.db, application.ID)
+		if deleteErr != nil {
+			h.log.Error("failed to delete env vars", "error", deleteErr)
+			http.Error(
+				writer,
+				"Internal Server Error",
+				http.StatusInternalServerError,
+			)
+
+			return
+		}
+
+		// Insert the full new set
+		for _, p := range pairs {
+			envVar := models.NewEnvVar(h.db)
+			envVar.AppID = application.ID
+			envVar.Key = p.key
+			envVar.Value = p.value
+
+			saveErr := envVar.Save(ctx)
+			if saveErr != nil {
+				h.log.Error(
+					"failed to save env var",
+					"key", p.key,
+					"error", saveErr,
+				)
+			}
+		}
+
+		http.Redirect(
 			writer,
 			request,
-			func(ctx context.Context, application *models.App, key, value string) error {
-				envVar := models.NewEnvVar(h.db)
-				envVar.AppID = application.ID
-				envVar.Key = key
-				envVar.Value = value
-
-				return envVar.Save(ctx)
-			},
+			"/apps/"+appID+"?success=env-updated",
+			http.StatusSeeOther,
 		)
 	}
 }
 
-// HandleEnvVarDelete handles deleting an environment variable.
-func (h *Handlers) HandleEnvVarDelete() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-		envVarIDStr := chi.URLParam(request, "varID")
+// envPair holds a parsed key-value pair from the env vars textarea.
+type envPair struct {
+	key   string
+	value string
+}
 
-		envVarID, parseErr := strconv.ParseInt(envVarIDStr, 10, 64)
-		if parseErr != nil {
-			http.NotFound(writer, request)
+// parseEnvPairs parses KEY=VALUE lines from a textarea string.
+// Blank lines and lines starting with # are skipped.
+func parseEnvPairs(text string) []envPair {
+	var pairs []envPair
 
-			return
+	for line := range strings.SplitSeq(text, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
 		}
 
-		envVar, findErr := models.FindEnvVar(request.Context(), h.db, envVarID)
-		if findErr != nil || envVar == nil || envVar.AppID != appID {
-			http.NotFound(writer, request)
-
-			return
+		key, value, ok := strings.Cut(line, "=")
+		if !ok || strings.TrimSpace(key) == "" {
+			continue
 		}
 
-		deleteErr := envVar.Delete(request.Context())
-		if deleteErr != nil {
-			h.log.Error("failed to delete env var", "error", deleteErr)
-		}
-
-		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+		pairs = append(pairs, envPair{
+			key:   strings.TrimSpace(key),
+			value: value,
+		})
 	}
+
+	return pairs
 }
 
 // HandleLabelAdd handles adding a label.
@@ -1205,59 +1252,6 @@ func ValidateVolumePath(p string) error {
 	return nil
 }
 
-// HandleEnvVarEdit handles editing an existing environment variable.
-func (h *Handlers) HandleEnvVarEdit() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-		envVarIDStr := chi.URLParam(request, "varID")
-
-		envVarID, parseErr := strconv.ParseInt(envVarIDStr, 10, 64)
-		if parseErr != nil {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		envVar, findErr := models.FindEnvVar(request.Context(), h.db, envVarID)
-		if findErr != nil || envVar == nil || envVar.AppID != appID {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		formErr := request.ParseForm()
-		if formErr != nil {
-			http.Error(writer, "Bad Request", http.StatusBadRequest)
-
-			return
-		}
-
-		key := request.FormValue("key")
-		value := request.FormValue("value")
-
-		if key == "" || value == "" {
-			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
-
-			return
-		}
-
-		envVar.Key = key
-		envVar.Value = value
-
-		saveErr := envVar.Save(request.Context())
-		if saveErr != nil {
-			h.log.Error("failed to update env var", "error", saveErr)
-		}
-
-		http.Redirect(
-			writer,
-			request,
-			"/apps/"+appID+"?success=env-updated",
-			http.StatusSeeOther,
-		)
-	}
-}
-
 // HandleLabelEdit handles editing an existing label.
 func (h *Handlers) HandleLabelEdit() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {