feat: NPM access list support (global default + per-project override)

internal/api/projects.go

@@ -13,13 +13,14 @@ import (
 
 // projectRequest is the expected JSON body for creating/updating a project.
 type projectRequest struct {
-	Name        string `json:"name"`
-	Registry    string `json:"registry"`
-	Image       string `json:"image"`
-	Port        int    `json:"port"`
-	Healthcheck string `json:"healthcheck"`
-	Env         string `json:"env"`
-	Volumes     string `json:"volumes"`
+	Name            string `json:"name"`
+	Registry        string `json:"registry"`
+	Image           string `json:"image"`
+	Port            int    `json:"port"`
+	Healthcheck     string `json:"healthcheck"`
+	Env             string `json:"env"`
+	Volumes         string `json:"volumes"`
+	NpmAccessListID *int   `json:"npm_access_list_id,omitempty"`
 }
 
 // listProjects handles GET /api/projects.
@@ -55,14 +56,20 @@ func (s *Server) createProject(w http.ResponseWriter, r *http.Request) {
 		req.Volumes = "{}"
 	}
 
+	npmAccessListID := 0
+	if req.NpmAccessListID != nil {
+		npmAccessListID = *req.NpmAccessListID
+	}
+
 	project, err := s.store.CreateProject(store.Project{
-		Name:        req.Name,
-		Registry:    req.Registry,
-		Image:       req.Image,
-		Port:        req.Port,
-		Healthcheck: req.Healthcheck,
-		Env:         req.Env,
-		Volumes:     req.Volumes,
+		Name:            req.Name,
+		Registry:        req.Registry,
+		Image:           req.Image,
+		Port:            req.Port,
+		Healthcheck:     req.Healthcheck,
+		Env:             req.Env,
+		Volumes:         req.Volumes,
+		NpmAccessListID: npmAccessListID,
 	})
 	if err != nil {
 		slog.Error("failed to create project", "error", err)
@@ -147,6 +154,9 @@ func (s *Server) updateProject(w http.ResponseWriter, r *http.Request) {
 	if req.Volumes != "" {
 		updated.Volumes = req.Volumes
 	}
+	if req.NpmAccessListID != nil {
+		updated.NpmAccessListID = *req.NpmAccessListID
+	}
 
 	if err := s.store.UpdateProject(updated); err != nil {
 		slog.Error("failed to update project", "error", err)