v4.2.2: token dialog and sidebar link fixes

🐛 Fixes

• API tokens: a new token can no longer be lost by a stray click. While the
  token is shown, clicking outside the dialog or pressing Escape no longer
  closes it. The token is shown only once and can't be revoked on its own, so
  closing it by accident left a valid token nobody had. Close the dialog with
  "Done" or the close button. (patch 0005)
• Sidebar: menu and dashboard links now open in a new tab. Their addresses
  lacked the Home Assistant ingress path, so "Open in new tab", middle-click
  and Ctrl/Cmd-click led to a Home Assistant error page. Normal clicks and
  port 81 were not affected. (patch 0004)

📝 Documentation

• The add-on's Documentation tab now covers the sidebar and API tokens.
• Corrected the 4.2.1 notes: Node.js 22.23.4 fixes 6 CVEs, not 7.

These came out of a review of the fork's own v4.1.0–v4.2.1 changes. Nothing
else changed: Nginx Proxy Manager 2.16.0, nginx 1.31.8, Node.js 22.23.4,
certbot 5.9.0 and debian-base 9.5.2 are all still the latest.

✅ Verification

Built and tested on real aarch64 hardware running Home Assistant OS: the
token dialog stays open on an outside click or Escape, menu and dashboard links
open in a new tab from the sidebar, and port 81 and the sidebar work as
before.