feat: SSL wildcard certificate picker from NPM

- NPM client: ListCertificates endpoint
- API: GET /api/settings/npm-certificates (wildcard-only filter)
- Settings UI: EntityPicker for selecting wildcard certs
- Deployer: applies certificate_id + ssl_forced to proxy hosts
- Uses HTTPS subdomain URLs when SSL cert is configured

internal/deployer/deployer.go

@@ -425,6 +425,15 @@ func (d *Deployer) configureProxy(
 		Locations:      []any{},
 	}
 
+	// Apply SSL certificate if configured in settings.
+	if settings.SSLCertificateID > 0 {
+		proxyConfig.CertificateID = settings.SSLCertificateID
+		proxyConfig.SSLForced = true
+		proxyConfig.HSTSEnabled = true
+		proxyConfig.HTTP2Support = true
+		d.logDeploy(deployID, fmt.Sprintf("Using SSL certificate ID %d", settings.SSLCertificateID), "info")
+	}
+
 	if found {
 		d.logDeploy(deployID, fmt.Sprintf("Updating existing proxy host %d for %s", existing.ID, fqdn), "info")
 		host, err := d.npm.UpdateProxyHost(ctx, existing.ID, proxyConfig)