feat: proxy routes page, OIDC login fix, NPM test connection, webhook URL fix, and UX improvements

- Add /proxies page showing deploy-managed proxy routes with project/stage links, search, and status
- Add GET /api/proxies endpoint joining instances with project/stage names
- Add POST /api/settings/npm/test endpoint for NPM connection validation
- Add GET /api/auth/mode public endpoint for auth mode detection
- Add NPM Test Connection button with validation on save
- Fix OIDC SSO button only shown when auth_mode is oidc
- Fix webhook URL showing empty when domain not set (fallback to request host)
- Fix quick deploy double-tag (image:latest:latest) by splitting tag from image URL
- Fix trim() errors on number inputs in deploy and settings forms
- Fix NPM client auto-append /api to base URL
- Sanitize NPM test error messages (no raw HTML)
- Remove healthcheck field from Quick Deploy form
- Fix env vars placeholder newline
- Make domain field optional in settings
- Set polling interval minimum to 60s
- Add Proxies and Events to sidebar navigation
- Fix SSL cert name flash on NPM settings page
- Fix empty state icon on proxies page

internal/npm/client.go

@@ -26,11 +26,15 @@ type Client struct {
 	password string
 }
 
-// New creates an NPM client targeting the given base URL (e.g. "http://npm:81/api").
-// The returned client is not yet authenticated — call Authenticate before other methods.
+// New creates an NPM client targeting the given base URL (e.g. "http://npm:81").
+// Automatically appends "/api" if not already present.
 func New(baseURL string) *Client {
+	u := strings.TrimRight(baseURL, "/")
+	if u != "" && !strings.HasSuffix(u, "/api") {
+		u += "/api"
+	}
 	return &Client{
-		baseURL: strings.TrimRight(baseURL, "/"),
+		baseURL: u,
 		httpClient: &http.Client{
 			Timeout: 30 * time.Second,
 		},