feat: SSL wildcard certificate picker from NPM

- NPM client: ListCertificates endpoint
- API: GET /api/settings/npm-certificates (wildcard-only filter)
- Settings UI: EntityPicker for selecting wildcard certs
- Deployer: applies certificate_id + ssl_forced to proxy hosts
- Uses HTTPS subdomain URLs when SSL cert is configured

web/src/lib/api.ts

@@ -4,6 +4,7 @@ import type {
 	DeployLog,
 	InspectResult,
 	Instance,
+	NpmCertificate,
 	Project,
 	ProjectDetail,
 	Registry,
@@ -258,6 +259,10 @@ export function regenerateWebhookUrl(): Promise<{ url: string }> {
 	return post<{ url: string }>('/api/settings/webhook-url/regenerate');
 }
 
+export function listNpmCertificates(): Promise<NpmCertificate[]> {
+	return get<NpmCertificate[]>('/api/settings/npm-certificates');
+}
+
 // ── Auth ─────────────────────────────────────────────────────────────
 
 export function login(username: string, password: string): Promise<{ token: string; expires_at: string }> {