refactor: POST env vars as JSON array instead of KEY=value string

Replace the string-serialized KEY=value format with a proper JSON array
of {key, value} objects for the env var save endpoint.

Frontend changes:
- envVarEditor.submitAll() now uses fetch() with Content-Type:
  application/json and X-CSRF-Token header instead of form submission
- Sends JSON array: [{"key":"FOO","value":"bar"}, ...]
- Hidden bulk form replaced with hidden div holding CSRF token
- envVarEditor now receives appId parameter for the fetch URL

Backend changes:
- HandleEnvVarSave reads JSON body via json.NewDecoder instead of
  parsing form values with parseEnvPairs
- Returns JSON {"ok": true} instead of HTTP redirect
- Removed parseEnvPairs function and envPair struct entirely
- Added envPairJSON struct with json tags for deserialization

Tests updated to POST JSON arrays instead of form-encoded strings.

Closes #163

internal/handlers/handlers_test.go

@@ -577,9 +577,8 @@ func TestHandleEnvVarSaveBulk(t *testing.T) {
 		require.NoError(t, ev.Save(context.Background()))
 	}
 
-	// Submit a new set via textarea
-	form := url.Values{}
-	form.Set("env_vars", "NEW_KEY=new_value\nANOTHER=42\n# comment line\n")
+	// Submit a new set as a JSON array of key/value objects
+	body := `[{"key":"NEW_KEY","value":"new_value"},{"key":"ANOTHER","value":"42"}]`
 
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
@@ -587,14 +586,14 @@ func TestHandleEnvVarSaveBulk(t *testing.T) {
 	request := httptest.NewRequest(
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
-		strings.NewReader(form.Encode()),
+		strings.NewReader(body),
 	)
-	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	request.Header.Set("Content-Type", "application/json")
 
 	recorder := httptest.NewRecorder()
 	r.ServeHTTP(recorder, request)
 
-	assert.Equal(t, http.StatusSeeOther, recorder.Code)
+	assert.Equal(t, http.StatusOK, recorder.Code)
 
 	// Verify old env vars are gone and new ones exist
 	envVars, err := models.FindEnvVarsByAppID(
@@ -621,8 +620,7 @@ func TestHandleEnvVarSaveAppNotFound(t *testing.T) {
 
 	testCtx := setupTestHandlers(t)
 
-	form := url.Values{}
-	form.Set("env_vars", "KEY=value\n")
+	body := `[{"key":"KEY","value":"value"}]`
 
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
@@ -630,9 +628,9 @@ func TestHandleEnvVarSaveAppNotFound(t *testing.T) {
 	request := httptest.NewRequest(
 		http.MethodPost,
 		"/apps/nonexistent-id/env",
-		strings.NewReader(form.Encode()),
+		strings.NewReader(body),
 	)
-	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	request.Header.Set("Content-Type", "application/json")
 
 	recorder := httptest.NewRecorder()
 	r.ServeHTTP(recorder, request)
@@ -758,8 +756,8 @@ func TestDeletePortOwnershipVerification(t *testing.T) {
 	assert.NotNil(t, found, "port should still exist after IDOR attempt")
 }
 
-// TestHandleEnvVarSaveEmptyClears verifies that submitting an empty textarea
-// deletes all existing env vars for the app.
+// TestHandleEnvVarSaveEmptyClears verifies that submitting an empty JSON
+// array deletes all existing env vars for the app.
 func TestHandleEnvVarSaveEmptyClears(t *testing.T) {
 	t.Parallel()
 
@@ -773,24 +771,21 @@ func TestHandleEnvVarSaveEmptyClears(t *testing.T) {
 	ev.Value = "gone"
 	require.NoError(t, ev.Save(context.Background()))
 
-	// Submit empty textarea
-	form := url.Values{}
-	form.Set("env_vars", "")
-
+	// Submit empty JSON array
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
 	request := httptest.NewRequest(
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
-		strings.NewReader(form.Encode()),
+		strings.NewReader("[]"),
 	)
-	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	request.Header.Set("Content-Type", "application/json")
 
 	recorder := httptest.NewRecorder()
 	r.ServeHTTP(recorder, request)
 
-	assert.Equal(t, http.StatusSeeOther, recorder.Code)
+	assert.Equal(t, http.StatusOK, recorder.Code)
 
 	// Verify all env vars are gone
 	envVars, err := models.FindEnvVarsByAppID(