v4.0.0 — Debian re-sync (Nginx Proxy Manager 2.16.0)

Re-sync with the re-architected upstream add-on. Upstream solved the Nginx
Proxy Manager v2.13+ frontend rewrite (webpack → Vite) by rebasing the whole
add-on from Alpine onto Debian; this release adopts that work.

⚠️ Breaking / major changes

• Base image switched from Alpine to Debian — now builds on
  ghcr.io/hassio-addons/debian-base:9.5.1 (Debian trixie). Supported
  architectures are unchanged (aarch64, amd64); 32-bit ARM remains dropped
  (since v3.0.0).
• Nginx Proxy Manager app v2.12.4 → v2.16.0 (frontend is now Vite +
  React 19 + TypeScript).
• nginx 1.30.2 (Alpine, stable) → 1.31.8 (nginx.org mainline Debian repo).
  The stream module is compiled in statically, so nginx-mod-stream is gone.
• Node.js 24 (Alpine) → 22 (NodeSource); the old webpack-era
  NODE_OPTIONS=--openssl-legacy-provider workaround is removed (Vite build).
• certbot now installed in a pip venv at /opt/certbot (certbot 5.8.0),
  pinned via PIP_CONSTRAINT, instead of the Alpine certbot package.
• Dependencies are now Debian apt packages (pinned to Debian trixie)
  instead of Alpine apk pins.

🔁 Patches

• Replaced the 6 Alpine-era patches with upstream's current 3
  (data-to-config-folder, keep-log-files-out-of-the-config-share,
  certbot-plugin-install-failures-at-startup). The old node-sass / webpack /
  sass-loader patches are obsolete under Vite; the logrotate and nginx
  root-user fixes are now carried by upstream itself.

🗂 Fork specifics

• Root repository.yaml (so this single add-on installs as a custom
  repository), config.yaml url pointing at this fork, and a single
  ARG BUILD_FROM base (no build.yaml).
• config.yaml map: uses the current spec's object form
  (type: app_config / read_only: false) instead of the deprecated
  addon_config:rw short form — same /config mount, no Supervisor
  deprecation warning.

✅ Verification

Built and ran clean on real aarch64 hardware (Home Assistant OS 18.4,
HA Core 2026.11.0b2, Supervisor 2026.10.5): the Vite yarn build, the
nginx.org / NodeSource apt repos, and certbot in its venv all succeeded; the
NPM backend came up on port 3000, database migrations ran, and logrotate was
clean.