NPM already answers which DNS providers it can drive

GET /nginx/certificates/dns-providers, authenticated, 86 entries on the 2.15.1
image here. verified against the live instance and against the file it reads
from, /app/certbot/dns-plugins.json in the container.

which settles how the provider picker gets built. the list is per install —
whatever certbot plugins that image carries — so curating one centrally and
shipping it as the truth would offer somebody a provider their NPM has never
heard of, take their API key, and fail at issue time with an error that does
not explain itself. ask the instance.

and NPM hands back each provider's credential TEMPLATE, carrying its own field
names. so the form is generated rather than written per provider, and it stays
right for providers we have never heard of. a curated list of ours is left with
the human half only: which we recommend, and how you actually get a key.

also noted: this endpoint answers 403 unauthenticated, not 404. the 404-means-
auth quirk is per route, not a property of the API. the client's heuristic
stays correct; the documentation of it was too broad.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

README.md

@@ -185,10 +185,14 @@ Verified against the live instance: a wrong credential comes back `likelyAuth =
 - **All of the above.** No domain registry, no DNS provider credentials, no named networks, no agent,
   no expose route. Everything from "What this is for" through "Private is a network the user names" is
   agreed and entirely unbuilt.
-- **Two things to check before building the DNS half.** NPM can only run the DNS proof for providers it
-  ships support for — a fixed list, not "any provider" — and if yours is missing, the proof has to be
-  done elsewhere and a finished certificate handed over, which is a much larger job. Neither the list
-  nor whether a given GoDaddy account still has DNS API access has been verified here.
+- **One thing left to check before building the DNS half.** Whether a given GoDaddy account still has
+  DNS API access — they restricted it by account size at some point, and it is unverified here.
+  Cloudflare is the safer provider to build against first.
+
+  The other half of this is now answered: **NPM tells you which providers it can drive**, over
+  `GET /nginx/certificates/dns-providers`, and it hands back each one's credential field names as a
+  template. 86 providers on the 2.15.1 image. So the picker asks the instance rather than trusting a
+  list of ours, and the form is generated from what NPM says. See `docs/npm-api.md`.
 - **Certificate expiry notifies nobody.** `daysUntilExpiry` is computed in `api/router.ts` and thrown
   away when the panel closes. NPM renews at 30 days; inside 14 means renewal has actually failed and the
   domain goes dark at zero. Nothing on the machine will say so.