api: env-aware deployments — family endpoint + list env + scoped vault

[mastermanas805]

Summary

Closes the gaps J flagged after §10.17 promote/copy roll-in (RETRO-2026-05-12).

• GET /api/v1/stacks now returns env + parent_stack_id per stack. Dashboard can stop hardcoding env: 'production'.
• NEW: GET /api/v1/stacks/:slug/family — Pro+ endpoint that returns root + every direct child as a flat list (with is_root, parent_stack_id, best-effort url from the primary exposed service, last_deploy_at). Same tier gate + agent_action contract as /promote. Cache-Control: private, max-age=60 — short enough to stay fresh across promotes, long enough to make env-tab nav snappy.
• ResolveVaultRefs now resolves against stack.Env rather than the hardcoded "production" string in two call sites (stack.New + stack.Redeploy). Staging stacks read from the staging vault, dev from dev. deploy.go was already correct.
• OpenAPI updated: /api/v1/stacks list documents env + parent_stack_id; new /api/v1/stacks/{slug}/family path documents the full 200/401/402/404 contract.
• Tests: 8 new family cases (tier gate, single env, multi env, fetch-via-child, cross-team 404, auth required, unknown slug 404, cache header) + TestStackList extended to assert env/parent_stack_id present.

Compute redeploy on promote is still deferred — that hook waits on Phase-1 POST /deploy/new along with the rest of the env-aware story.

Test plan

• make test-unit — all packages green
• go build ./... clean
• go vet ./... clean
• After merge: deploy + smoke curl -H "Authorization: Bearer …" https://api.instanode.dev/api/v1/stacks/<slug>/family

ResolveVaultRefs call sites updated

• internal/handlers/stack.go::New (line ~603) — now uses stack.Env
• internal/handlers/stack.go::Redeploy (line ~975) — now uses stack.Env
• internal/handlers/deploy.go::deploy (line ~150) — was already correct (uses d.Env)

🤖 Generated with Claude Code