feat: SSL wildcard certificate picker from NPM

- NPM client: ListCertificates endpoint
- API: GET /api/settings/npm-certificates (wildcard-only filter)
- Settings UI: EntityPicker for selecting wildcard certs
- Deployer: applies certificate_id + ssl_forced to proxy hosts
- Uses HTTPS subdomain URLs when SSL cert is configured

internal/api/router.go

@@ -131,6 +131,7 @@ func (s *Server) Router() chi.Router {
 				r.Get("/images", s.listRegistryImages)
 			})
 			r.Get("/settings", s.getSettings)
+			r.Get("/settings/npm-certificates", s.listNpmCertificates)
 
 			// Admin-only routes: require admin role.
 			r.Group(func(r chi.Router) {