feat: add safe application env upsert

[agentHits]

What is this PR about?

This PR adds a safe partial environment variable upsert endpoint for applications. API and MCP clients can now add or update selected application environment variables without reading or replacing the full env block, which avoids deleting existing secrets when the current env is redacted.

The new application.env.upsert mutation reads the current env server-side, merges submitted variables by key, and returns metadata only. It supports dryRun, optional expectedRevision conflict protection, and optional redeploy when the caller also has deployment permission.

Checklist

Before submitting this PR, please make sure that:

• You created a dedicated branch based on the canary branch.
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance. If you have not tested it yet, please do so before submitting. This helps avoid wasting maintainers' time reviewing code that has not been verified by you.

Issues related (if applicable)

Closes #4525

Screenshots (if applicable)

Verification

• corepack pnpm --filter=dokploy exec vitest run --config __test__/vitest.config.ts __test__/env/upsert.test.ts __test__/env/application-env-upsert.test.ts
• corepack pnpm exec biome check apps/dokploy/server/api/routers/application.ts packages/server/src/db/schema/application.ts packages/server/src/index.ts packages/server/src/services/application.ts packages/server/src/utils/env-upsert.ts apps/dokploy/__test__/env/upsert.test.ts apps/dokploy/__test__/env/application-env-upsert.test.ts
• corepack pnpm --filter @dokploy/server run typecheck
• corepack pnpm --filter=dokploy run typecheck
• corepack pnpm --filter=dokploy run generate:openapi
• Verified locally in Swagger that POST /application.env.upsert is exposed.

Note: I did not commit openapi.json because the repository has a post-merge Generate and Sync OpenAPI workflow that regenerates and syncs the OpenAPI artifact to Dokploy, MCP, CLI, SDK, and docs repositories after changes land on canary.