feat: proxy routes page, OIDC login fix, NPM test connection, webhook URL fix, and UX improvements

- Add /proxies page showing deploy-managed proxy routes with project/stage links, search, and status
- Add GET /api/proxies endpoint joining instances with project/stage names
- Add POST /api/settings/npm/test endpoint for NPM connection validation
- Add GET /api/auth/mode public endpoint for auth mode detection
- Add NPM Test Connection button with validation on save
- Fix OIDC SSO button only shown when auth_mode is oidc
- Fix webhook URL showing empty when domain not set (fallback to request host)
- Fix quick deploy double-tag (image:latest:latest) by splitting tag from image URL
- Fix trim() errors on number inputs in deploy and settings forms
- Fix NPM client auto-append /api to base URL
- Sanitize NPM test error messages (no raw HTML)
- Remove healthcheck field from Quick Deploy form
- Fix env vars placeholder newline
- Make domain field optional in settings
- Set polling interval minimum to 60s
- Add Proxies and Events to sidebar navigation
- Fix SSL cert name flash on NPM settings page
- Fix empty state icon on proxies page

internal/store/instances.go

@@ -119,6 +119,59 @@ func (s *Store) ListAllInstances() ([]Instance, error) {
 	return instances, rows.Err()
 }
 
+// ProxyRoute represents a proxy-enabled instance with project and stage names.
+type ProxyRoute struct {
+	InstanceID   string `json:"instance_id"`
+	ProjectID    string `json:"project_id"`
+	ProjectName  string `json:"project_name"`
+	StageID      string `json:"stage_id"`
+	StageName    string `json:"stage_name"`
+	ImageTag     string `json:"image_tag"`
+	Subdomain    string `json:"subdomain"`
+	Domain       string `json:"domain"`
+	ContainerID  string `json:"container_id"`
+	Port         int    `json:"port"`
+	ProxyRouteID string `json:"proxy_route_id"`
+	NpmProxyID   int    `json:"npm_proxy_id"`
+	Status       string `json:"status"`
+	CreatedAt    string `json:"created_at"`
+}
+
+// ListProxyRoutes returns all instances that have a proxy configured, joined with project/stage names.
+func (s *Store) ListProxyRoutes(domain string) ([]ProxyRoute, error) {
+	rows, err := s.db.Query(`
+		SELECT i.id, i.project_id, p.name, i.stage_id, s.name,
+		       i.image_tag, i.subdomain, i.container_id, i.port,
+		       i.proxy_route_id, i.npm_proxy_id, i.status, i.created_at
+		FROM instances i
+		JOIN projects p ON p.id = i.project_id
+		JOIN stages s ON s.id = i.stage_id
+		WHERE i.subdomain != '' AND (i.proxy_route_id != '' OR i.npm_proxy_id > 0)
+		ORDER BY p.name, s.name, i.created_at DESC`,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("query proxy routes: %w", err)
+	}
+	defer rows.Close()
+
+	routes := []ProxyRoute{}
+	for rows.Next() {
+		var r ProxyRoute
+		if err := rows.Scan(
+			&r.InstanceID, &r.ProjectID, &r.ProjectName, &r.StageID, &r.StageName,
+			&r.ImageTag, &r.Subdomain, &r.ContainerID, &r.Port,
+			&r.ProxyRouteID, &r.NpmProxyID, &r.Status, &r.CreatedAt,
+		); err != nil {
+			return nil, fmt.Errorf("scan proxy route: %w", err)
+		}
+		if domain != "" && r.Subdomain != "" {
+			r.Domain = r.Subdomain + "." + domain
+		}
+		routes = append(routes, r)
+	}
+	return routes, rows.Err()
+}
+
 // UpdateInstance updates an existing instance's mutable fields.
 func (s *Store) UpdateInstance(inst Instance) error {
 	inst.UpdatedAt = Now()