Align to NPM 2.14.0 (React/TS frontend port)

[inkly]

Summary

Aligns this fork to upstream NginxProxyManager v2.14.0, which is a near-total rewrite of the frontend in React/TypeScript plus an ESM backend migration. All open-appsec WAF customizations have been preserved and re-implemented on top of the new stack.

Last alignment (#37 by @roybarda) brought us to NPM 2.12.3. This PR continues the same effort.

Release tag: `v2.14.0-appsec.1` (pushed to inkly fork).

Why this PR is big

NPM v2.13 → v2.14 deleted the entire EJS/jQuery frontend (`frontend/js/app/**`) and replaced it with React/TS under `frontend/src/`. The same delete-and-rebuild applied to every fork-side open-appsec UI surface. About 600 of the 648 commits in this PR are inherited from NginxProxyManager between v2.12.3 and v2.14.0; the rest is the open-appsec port itself (50 commits).

What changed

Layer	Work
Backend	Resolved merge conflicts on `proxy-host.js`, schemas, route mounts. Converted 6 fork modules from CJS to ESM (v2.14 set `backend/package.json` to `"type": "module"`). Added Knex migration `20260513120000_open_appsec.js` for the per-host appsec columns. Fixed two latent bugs in fork code in passing (missing `readline` import; `data` referenced before declaration in `nginx-openappsec.js`).
Docker	Re-applied attachment install patches (`docker/lib/*.so` copies + `load_module` sed on nginx.conf) against v2.14's restructured Dockerfile. Bumped `Dockerfile.central-mgmt` base to `jc21/nginx-proxy-manager:2.14.0`.
Frontend	Re-implemented every open-appsec EJS surface as React/TS: Settings page (YAML editor for local policy), Login branding, sidebar menu entry, ProxyHostModal 5th tab + per-location overrides, and the open-appsec log section as a 4-tab page (All / Detailed / Important / Notifications) with details modal and client-side filtering matching the original fork's semantics (telemetry exclusion on All, severity-based Important, source/level-based Notifications).
i18n	38 new keys across all 20 locale source files. Real English + French; English fallback elsewhere. `prebuild` hook added so `vite build` always recompiles `src/locale/lang/`.
Tooling	`.gitattributes` added to enforce LF on docker/scripts/deployment/backend/frontend, preventing Windows-clone CRLF artifacts from breaking shebangs and s6 service scripts.

Notable design decisions

• Settings page is a YAML editor, not a structured form. Because `backend/internal/setting-openappsec.js getLocalPolicy()` returns the local policy YAML as an opaque string, a structured form would force lossy parse/reserialize roundtrips. Power users edit the policy directly; for the most-common per-host knobs (mode, confidence), structured controls live in the ProxyHost modal (per-host) — which matches where they actually belong.
• "All" log tab filters telemetry (`waap telemetry`, `waap attack type telemetry`, `ips stats`) to match the original fork's `frontend/js/app/openappsec-log/main.js` semantics. A new "Detailed" tab is a synthesized power-user view that shows everything including telemetry.
• The migration creates the `use_openappsec`/`minimum_confidence`/`openappsec_mode` columns on `proxy_host` but `proxy-host.js` strips them from SQL writes and overlays them from the YAML on reads — by design (the YAML is the source of truth). The columns are effectively unused; consider removing or documenting in a follow-up.

Pre-existing upstream NPM bug fixed in this PR

`backend/lib/access.js:274` had a missing `new` keyword:

```diff

•   		throw errs.PermissionError("Permission Denied", err);
  

•   		throw new errs.PermissionError("Permission Denied", err);
  

```

Without `new`, the strict-mode ESM call returns `undefined` and the line effectively becomes `throw undefined`. Express interprets `next(undefined)` as "no error", so every permission failure surfaces as a 404 (via the catch-all in `routes/main.js`) instead of the intended 403. The same fix has been filed against NginxProxyManager upstream.

End-to-end smoke validation

Validated on a Docker stack against this branch (Docker Desktop on Windows, NPM container + appsec-agent on shared network):

• `scripts/ci/frontend-build` produces `frontend/dist/` in 1m 1s.
• `docker build -f docker/Dockerfile -t open-appsec-npm:2.14.0-appsec.1 .` succeeds (1.66 GB image).
• `docker compose up -d` with NPM + appsec-agent: both containers healthy.
• Migration `[open_appsec] proxy_host Table altered` runs cleanly on a fresh SQLite DB.
• Backend boots, all open-appsec ESM modules load.
• `GET /api/openappsec-settings` returns the local policy YAML.
• `POST /api/nginx/proxy-hosts` with `use_openappsec: true, openappsec_mode: "prevent-learn", minimum_confidence: "high"` succeeds and writes the correct `specific-rules` and `practices` entries into the shared YAML.
• `GET /api/nginx/proxy-hosts/{id}` correctly overlays the YAML values onto the response.
• WAF curl test passes: SQL injection (`?id=1' OR '1'='1`) and XSS payloads against the proxied host are blocked by open-appsec. Agent log shows `securityAction: "Prevent"`, `waapIncidentType: "SQL Injection"`, `eventConfidence: "Very High"`, final score 1000/1000.
• `GET /api/openappsec-log` (authenticated) returns the WAF event records, ready to be consumed by the new React log section.

Documentation included in this PR

• `docs/superpowers/plans/2026-05-13-npm-2.14-port.md` — 7-phase implementation plan with file map and per-phase task checklists.
• `docs/superpowers/plans/2026-05-13-npm-2.14-port-audit.md` — per-phase summary, full 91-file inventory grouped by area, build pipeline, open minor concerns, runtime smoke checklist (all green).

Known minor concerns (non-blocking, candidates for follow-up)

• `backend/templates/openappsec.conf` is a dead Liquid template (no live reference); safe to remove in a cleanup.
• The unused `use_openappsec`/`minimum_confidence`/`openappsec_mode` columns on `proxy_host` (see "Notable design decisions" above).
• Empty-state strings on the four log tabs and modal field labels in `OpenAppsecFields.tsx` remain English-only; minor i18n polish.
• 2.3 MB main bundle warning persists from upstream's chunking choices (no `manualChunks` config).

Test plan

• tsc clean across the frontend
• biome lint clean on all touched files
• vite build succeeds (one pre-existing chunk-size warning)
• docker build succeeds
• docker compose stack runs healthy
• Migration applies cleanly on fresh DB
• WAF curl smoke (SQLi + XSS) blocks at the proxy, surfaces in /api/openappsec-log
• Cypress e2e suite against this branch
• Manual UI walkthrough in a browser (Settings YAML editor, ProxyHost open-appsec tab, log section tabs)