proxy-manager: nginx proxy manager in officer

reads hosts and certificates against a live NPM 2.15.1. one grantable
permission, with /_config owner-only — reading which hosts are healthy
is worth sharing, an NPM admin login is not, and NPM has no read-only
role.

the quirk that shapes the whole plugin: NPM answers an unauthenticated
read with 404, not 401, because its router only registers a resource
once a token is present. so 'not signed in' and 'no such endpoint' are
the same response, and a naive client tells you a feature is missing
when your password is wrong. the client mints a fresh token and retries
once, then reports a persistent 404 as likelyAuth.

certificates sort by expiry rather than name, which is the only ordering
that answers a question.

no create/edit/delete and no cert issuance: NPM's own UI does those and
a wrong proxy host takes a domain off the internet.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

manifest.ts

@@ -0,0 +1,45 @@
+import type { PluginManifest } from '@@/plugins/manifest';
+
+// Nginx Proxy Manager, inside Officer.
+//
+// ── The name ──
+//
+// The container is called `npm` and the owner calls it NPM. This plugin is `proxy-manager` anyway: in a
+// repository where every other sentence is about bun, lockfiles and `npm install`, a plugin directory
+// called `npm` would collide with the package manager in every grep and every conversation. The label
+// says the real name; the id says what it does. Same reasoning that renamed `officer-claude` to
+// `officer-anthropic-proxy`.
+//
+// ── The permission, and why settings are carved out ──
+//
+// Reading which hosts exist, whether their certificates are healthy and whether one is offline is
+// genuinely useful to somebody who is not the owner. The CREDENTIAL is not: it is an NPM admin login,
+// and NPM has no read-only role, so anyone holding it can redirect any hostname on this machine.
+//
+// So the permission is grantable and `/_config` is owner-only — the split `ownerOnly` exists for, and
+// the same shape Jellyfin uses for its admin token.
+export const manifest: PluginManifest = {
+  publisher: 'officerdev',
+  version: '0.1.0',
+  platform: '>=1.0.0',
+
+  label: 'Proxy Manager',
+  summary: 'Nginx Proxy Manager — hosts, certificates and access lists',
+  icon: 'Route',
+  color: '#f97316',
+
+  permissions: [
+    {
+      key: 'proxy-manager',
+      label: 'Proxy Manager',
+      description: 'Nginx Proxy Manager — proxy hosts, redirections, streams and certificates',
+
+      // The connection form and the probe. Everything under here reads or writes the admin credential.
+      ownerOnly: ['/_config'],
+
+      // Probes that look like writes and are not. Without declaring these a read-level account meets
+      // what reads as a broken feature: the "test connection" button 403s.
+      readOnlyWrites: ['/_config/test'],
+    },
+  ],
+};