Phase 16: volumes page, multi-host (0.17.0)

Adds a dedicated Volumes page (sidebar) with per-host sections (local + each
online agent), matching the Networks/Images layout. Lists volumes with driver,
owning stack, in-use containers and mountpoint; admins can delete (with an
in-use warning + force option) and prune unused, plus an "only unused" filter.

- agent_app.py: /agent/volumes (list/delete with in-use 409 guard/prune)
  reusing volume_service.
- routers/agents.py: proxy routes /api/agents/{id}/volumes/* (audit-logged
  delete/prune).
- Frontend: volumesApi list/remove/prune take an optional agentId; new
  pages/Volumes.tsx (VolumesSection per host) + sidebar entry + /volumes route.
  The volume wizard (generate-yaml/host paths) stays local and unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/agent_app.py

@@ -44,6 +44,7 @@ from services import (
     image_service,
     network_service,
     update_service,
+    volume_service,
 )
 
 logger = logging.getLogger("stackpilot.agent")
@@ -59,7 +60,7 @@ def _map_docker(exc: DockerError):
         raise HTTPException(status_code=code, detail=exc.detail or exc.error)
     raise exc  # falls through to the global 502 DockerError handler
 
-AGENT_VERSION = "0.16.0"
+AGENT_VERSION = "0.17.0"
 
 
 # --------------------------------------------------------------------------- #
@@ -436,6 +437,36 @@ async def image_check() -> dict:
     return await update_service.check_all()
 
 
+# --------------------------------------------------------------------------- #
+# Volumes
+# --------------------------------------------------------------------------- #
+
+
+@app.get("/agent/volumes", dependencies=[Depends(verify_token)])
+def list_volumes() -> list[dict]:
+    return volume_service.list_volumes()
+
+
+@app.delete("/agent/volumes/{name}", dependencies=[Depends(verify_token)])
+def delete_volume(name: str, force: bool = Query(False)) -> dict:
+    vols = {v["name"]: v for v in volume_service.list_volumes()}
+    if name in vols and vols[name]["in_use"] and not force:
+        raise HTTPException(
+            status_code=409,
+            detail={
+                "error": "volume_in_use",
+                "detail": f"Volume '{name}' is used by: {', '.join(vols[name]['used_by'])}",
+            },
+        )
+    volume_service.remove_volume(name, force=force)
+    return {"ok": True}
+
+
+@app.post("/agent/volumes/prune", dependencies=[Depends(verify_token)])
+def prune_volumes() -> dict:
+    return volume_service.prune_volumes()
+
+
 # --------------------------------------------------------------------------- #
 # File browser (sandboxed by this agent's ALLOWED_BROWSE_ROOTS/HOST_ROOT_PREFIX)
 # --------------------------------------------------------------------------- #

backend/main.py

@@ -55,7 +55,7 @@ async def lifespan(app: FastAPI):
     schedule_task.cancel()
 
 
-app = FastAPI(title="StackPilot", version="0.16.0", lifespan=lifespan)
+app = FastAPI(title="StackPilot", version="0.17.0", lifespan=lifespan)
 
 app.add_middleware(
     CORSMiddleware,

backend/routers/agents.py

@@ -645,6 +645,57 @@ async def agent_image_check(
     return result
 
 
+# --------------------------------------------------------------------------- #
+# Volumes (proxied)
+# --------------------------------------------------------------------------- #
+
+
+@router.get("/{agent_id}/volumes")
+async def agent_volumes(
+    agent_id: int,
+    session: Session = Depends(get_session),
+    _user: User = Depends(get_current_user),
+) -> list[dict]:
+    agent = _get_or_404(session, agent_id)
+    return await _proxy(session, agent, "GET", "/agent/volumes") or []
+
+
+@router.post("/{agent_id}/volumes/prune")
+async def agent_volumes_prune(
+    agent_id: int,
+    request: Request,
+    session: Session = Depends(get_session),
+    user: User = Depends(require_admin),
+) -> dict:
+    agent = _get_or_404(session, agent_id)
+    result = await _proxy(session, agent, "POST", "/agent/volumes/prune")
+    audit_service.record(
+        session, user=user.username, action="agent.volume.prune", target=agent.name,
+        detail=str(result.get("VolumesDeleted") or []), ip=_ip(request),
+    )
+    return result
+
+
+@router.delete("/{agent_id}/volumes/{name}")
+async def agent_volume_delete(
+    agent_id: int,
+    name: str,
+    request: Request,
+    force: bool = Query(False),
+    session: Session = Depends(get_session),
+    user: User = Depends(require_admin),
+) -> dict:
+    agent = _get_or_404(session, agent_id)
+    result = await _proxy(
+        session, agent, "DELETE", f"/agent/volumes/{name}", params={"force": force}
+    )
+    audit_service.record(
+        session, user=user.username, action="agent.volume.delete",
+        target=f"{agent.name}/{name}", ip=_ip(request),
+    )
+    return result
+
+
 # --------------------------------------------------------------------------- #
 # File browser (proxied)
 # --------------------------------------------------------------------------- #