feat: proxy provider UI, webhook URL fix, and dev-server key persistence

- Add proxy provider selector (None/NPM) to settings page with radio cards
- Show warning when switching to None about existing NPM routes
- Conditionally hide SSL certificate picker and NPM credentials when provider is None
- Fix webhook URL regenerate not updating UI (field name mismatch: url vs webhook_url)
- Fix dev-server.sh to persist ENCRYPTION_KEY across restarts via data/.dev-key
- Fix selected radio card background visibility in dark mode

web/src/lib/i18n/en.json

@@ -238,7 +238,14 @@
     "backup": "Backups",
     "appearance": "Appearance",
     "staleThreshold": "Stale threshold (days)",
-    "staleThresholdHelp": "Containers inactive for longer than this will be flagged as stale."
+    "staleThresholdHelp": "Containers inactive for longer than this will be flagged as stale.",
+    "proxyProvider": "Proxy Provider",
+    "proxyProviderHelp": "Select how reverse proxy routes are managed for deployed containers.",
+    "proxyNone": "None",
+    "proxyNoneDesc": "No proxy — containers are accessed directly by port",
+    "proxyNpm": "Nginx Proxy Manager",
+    "proxyNpmDesc": "Routes managed via NPM API (configure credentials below)",
+    "proxyNoneWarning": "Switching to None does not remove existing proxy routes from NPM. You can delete them manually from your NPM dashboard."
   },
   "settingsGeneral": {
     "title": "General Settings",