feat: NPM access list support (global default + per-project override)

internal/npm/client.go

@@ -175,6 +175,15 @@ func (c *Client) FindProxyHostByDomain(ctx context.Context, domain string) (Prox
 	return ProxyHost{}, false, nil
 }
 
+// ListAccessLists returns all access lists from NPM.
+func (c *Client) ListAccessLists(ctx context.Context) ([]AccessList, error) {
+	var lists []AccessList
+	if err := c.doJSON(ctx, http.MethodGet, "/nginx/access-lists", nil, &lists); err != nil {
+		return nil, fmt.Errorf("list access lists: %w", err)
+	}
+	return lists, nil
+}
+
 // ListCertificates returns all SSL certificates from NPM.
 func (c *Client) ListCertificates(ctx context.Context) ([]Certificate, error) {
 	var certs []Certificate

internal/npm/types.go

@@ -50,6 +50,12 @@ type ProxyHost struct {
 	ModifiedOn       string   `json:"modified_on"`
 }
 
+// AccessList represents an access list as returned by the NPM API.
+type AccessList struct {
+	ID   int    `json:"id"`
+	Name string `json:"name"`
+}
+
 // Certificate represents an SSL certificate as returned by the NPM API.
 type Certificate struct {
 	ID          int      `json:"id"`