feat: NPM access list support (global default + per-project override)

internal/deployer/bluegreen.go

@@ -87,6 +87,8 @@ func (d *Deployer) blueGreenDeploy(
 		Stage:        stage.Name,
 		InstanceID:   instanceID,
 		Mounts:       mounts,
+		CpuLimit:     stage.CpuLimit,
+		MemoryLimit:  stage.MemoryLimit,
 	}
 
 	// Set proxy labels for providers that use Docker labels (e.g., Traefik).
@@ -162,7 +164,12 @@ func (d *Deployer) blueGreenDeploy(
 		}
 		d.publishDeployStatus(deployID, project.ID, stage.ID, imageTag, "configuring_proxy", "")
 
-		proxyRouteID, err = d.configureProxy(ctx, deployID, settings, containerID, containerName, project.Port, subdomain)
+		accessListID := settings.NpmAccessListID
+		if project.NpmAccessListID > 0 {
+			accessListID = project.NpmAccessListID
+		}
+
+		proxyRouteID, err = d.configureProxy(ctx, deployID, settings, containerID, containerName, project.Port, subdomain, accessListID)
 		if err != nil {
 			return containerID, "", instanceID, fmt.Errorf("configure proxy: %w", err)
 		}

internal/deployer/deployer.go

@@ -325,6 +325,8 @@ func (d *Deployer) executeDeploy(
 		Stage:        stage.Name,
 		InstanceID:   instanceID,
 		Mounts:       mounts,
+		CpuLimit:     stage.CpuLimit,
+		MemoryLimit:  stage.MemoryLimit,
 	}
 
 	// Set proxy labels for providers that use Docker labels (e.g., Traefik).
@@ -389,7 +391,12 @@ func (d *Deployer) executeDeploy(
 		}
 		d.publishDeployStatus(deployID, project.ID, stage.ID, imageTag, "configuring_proxy", "")
 
-		proxyRouteID, err = d.configureProxy(ctx, deployID, settings, containerID, containerName, project.Port, subdomain)
+		accessListID := settings.NpmAccessListID
+		if project.NpmAccessListID > 0 {
+			accessListID = project.NpmAccessListID
+		}
+
+		proxyRouteID, err = d.configureProxy(ctx, deployID, settings, containerID, containerName, project.Port, subdomain, accessListID)
 		if err != nil {
 			return containerID, proxyRouteID, instanceID, fmt.Errorf("configure proxy: %w", err)
 		}
@@ -445,6 +452,7 @@ func (d *Deployer) configureProxy(
 	containerName string,
 	containerPort int,
 	subdomain string,
+	accessListID int,
 ) (string, error) {
 	fqdn := subdomain + "." + settings.Domain
 
@@ -470,6 +478,7 @@ func (d *Deployer) configureProxy(
 
 	routeID, err := d.proxy.ConfigureRoute(ctx, fqdn, forwardHost, forwardPort, proxy.RouteOptions{
 		SSLCertificateID: settings.SSLCertificateID,
+		AccessListID:     accessListID,
 	})
 	if err != nil {
 		return "", fmt.Errorf("configure proxy route: %w", err)