feat: NPM access list support (global default + per-project override)

internal/npm/client.go

@@ -175,6 +175,15 @@ func (c *Client) FindProxyHostByDomain(ctx context.Context, domain string) (Prox
 	return ProxyHost{}, false, nil
 }
 
+// ListAccessLists returns all access lists from NPM.
+func (c *Client) ListAccessLists(ctx context.Context) ([]AccessList, error) {
+	var lists []AccessList
+	if err := c.doJSON(ctx, http.MethodGet, "/nginx/access-lists", nil, &lists); err != nil {
+		return nil, fmt.Errorf("list access lists: %w", err)
+	}
+	return lists, nil
+}
+
 // ListCertificates returns all SSL certificates from NPM.
 func (c *Client) ListCertificates(ctx context.Context) ([]Certificate, error) {
 	var certs []Certificate