Add SSL certificate mode: Let's Encrypt or Wildcard per NPM

Settings > NPM Integration now allows choosing between per-customer
Let's Encrypt certificates (default) or a shared wildcard certificate
already uploaded in NPM. Includes backend, frontend UI, and i18n support.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/database.py

@@ -83,6 +83,8 @@ def _run_migrations() -> None:
         ("system_config", "mfa_enabled", "BOOLEAN DEFAULT 0"),
         ("users", "totp_secret_encrypted", "TEXT"),
         ("users", "totp_enabled", "BOOLEAN DEFAULT 0"),
+        ("system_config", "ssl_mode", "TEXT DEFAULT 'letsencrypt'"),
+        ("system_config", "wildcard_cert_id", "INTEGER"),
     ]
     for table, column, col_type in migrations:
         if not _has_column(table, column):