refactor: extract ProxyProvider interface with None and NPM implementations

Replace direct npm.Client usage throughout the codebase with the
proxy.Provider interface, enabling pluggable proxy backends. The
deployer, API layer, and proxy manager now use provider-agnostic
route management (ConfigureRoute/DeleteRoute) instead of NPM-specific
API calls. Adds ProxyRouteID (string) to Instance model and
ProxyProvider setting to Settings, with SQLite migrations for
backward compatibility.

internal/api/router.go

@@ -26,10 +26,11 @@ type DNSProviderChangedFunc func(provider dns.Provider)
 
 // Server holds all dependencies for the API layer.
 type Server struct {
-	store        *store.Store
-	docker       *docker.Client
-	npm          *npm.Client
-	deployer     DeployTriggerer
+	store         *store.Store
+	docker        *docker.Client
+	npm           *npm.Client         // optional: only for NPM-specific endpoints (certificates)
+	proxyProvider proxy.Provider
+	deployer      DeployTriggerer
 	webhook      *webhook.Handler
 	eventBus     *events.Bus
 	encKey       [32]byte
@@ -53,6 +54,7 @@ func NewServer(
 	st *store.Store,
 	dockerClient *docker.Client,
 	npmClient *npm.Client,
+	proxyProvider proxy.Provider,
 	deployer DeployTriggerer,
 	webhookHandler *webhook.Handler,
 	eventBus *events.Bus,
@@ -61,14 +63,15 @@ func NewServer(
 	localAuth := auth.NewLocalAuth(encKey)
 
 	s := &Server{
-		store:     st,
-		docker:    dockerClient,
-		npm:       npmClient,
-		deployer:  deployer,
-		webhook:   webhookHandler,
-		eventBus:  eventBus,
-		encKey:    encKey,
-		localAuth: localAuth,
+		store:         st,
+		docker:        dockerClient,
+		npm:           npmClient,
+		proxyProvider: proxyProvider,
+		deployer:      deployer,
+		webhook:       webhookHandler,
+		eventBus:      eventBus,
+		encKey:        encKey,
+		localAuth:     localAuth,
 	}
 
 	// Try to initialize OIDC provider from stored settings.