feat: SSL wildcard certificate picker from NPM

- NPM client: ListCertificates endpoint
- API: GET /api/settings/npm-certificates (wildcard-only filter)
- Settings UI: EntityPicker for selecting wildcard certs
- Deployer: applies certificate_id + ssl_forced to proxy hosts
- Uses HTTPS subdomain URLs when SSL cert is configured

web/src/lib/api.ts

@@ -4,6 +4,7 @@ import type {
 	DeployLog,
 	InspectResult,
 	Instance,
+	NpmCertificate,
 	Project,
 	ProjectDetail,
 	Registry,
@@ -258,6 +259,10 @@ export function regenerateWebhookUrl(): Promise<{ url: string }> {
 	return post<{ url: string }>('/api/settings/webhook-url/regenerate');
 }
 
+export function listNpmCertificates(): Promise<NpmCertificate[]> {
+	return get<NpmCertificate[]>('/api/settings/npm-certificates');
+}
+
 // ── Auth ─────────────────────────────────────────────────────────────
 
 export function login(username: string, password: string): Promise<{ token: string; expires_at: string }> {

web/src/lib/i18n/en.json

@@ -207,7 +207,14 @@
     "regenerating": "Regenerating...",
     "regenerated": "Webhook URL regenerated",
     "regenerateFailed": "Failed to regenerate webhook URL",
-    "regenerateWarning": "Warning: regenerating will invalidate the current URL. Update your CI pipelines."
+    "regenerateWarning": "Warning: regenerating will invalidate the current URL. Update your CI pipelines.",
+    "sslCertificate": "SSL Certificate",
+    "sslCertificateHelp": "Wildcard certificate from NPM for auto-SSL on proxy hosts",
+    "selectCertificate": "Select Certificate",
+    "noCertificate": "None (no SSL)",
+    "clearCertificate": "Clear",
+    "loadingCertificates": "Loading certificates...",
+    "noCertificatesFound": "No wildcard certificates found in NPM"
   },
   "settingsRegistries": {
     "title": "Container Registries",

web/src/lib/i18n/ru.json

@@ -207,7 +207,14 @@
     "regenerating": "Перегенерация...",
     "regenerated": "URL вебхука перегенерирован",
     "regenerateFailed": "Не удалось перегенерировать URL вебхука",
-    "regenerateWarning": "Внимание: перегенерация сделает текущий URL недействительным. Обновите ваши CI-пайплайны."
+    "regenerateWarning": "Внимание: перегенерация сделает текущий URL недействительным. Обновите ваши CI-пайплайны.",
+    "sslCertificate": "SSL-сертификат",
+    "sslCertificateHelp": "Wildcard-сертификат из NPM для автоматического SSL на прокси-хостах",
+    "selectCertificate": "Выбрать сертификат",
+    "noCertificate": "Нет (без SSL)",
+    "clearCertificate": "Очистить",
+    "loadingCertificates": "Загрузка сертификатов...",
+    "noCertificatesFound": "Wildcard-сертификаты в NPM не найдены"
   },
   "settingsRegistries": {
     "title": "Реестры контейнеров",

web/src/lib/types.ts

@@ -105,9 +105,19 @@ export interface Settings {
 	webhook_secret: string;
 	polling_interval: string;
 	base_volume_path: string;
+	ssl_certificate_id: number;
 	updated_at: string;
 }
 
+/** An SSL certificate from Nginx Proxy Manager. */
+export interface NpmCertificate {
+	id: number;
+	nice_name: string;
+	domain_names: string[];
+	expires_on: string;
+	provider: string;
+}
+
 /** Standard API envelope returned by all backend endpoints. */
 export interface ApiEnvelope<T> {
 	success: boolean;