Add opt-in HTTP/3 support for proxy hosts

[RentnerKev]

Why

This is the HTTP/3 portion of #5803, split out following the maintainer's request. It targets develop independently and does not include gzip controls or configurable cache lifetimes. Those portions are in #5816 (gzip) and #5815 (caching).

Related to #1550 and #2834. As noted in the original PR, #5587 also proposes HTTP/3 support; this preserves the per-host controls and UDP-port conflict handling from #5803 in a separate reviewable PR.

What Changed

• Add opt-in HTTP/3 support per TLS Proxy Host, independently of HTTP/2; HTTP/1.1 remains available.
• Generate a shared QUIC listener only when needed and advertise Alt-Svc only for eligible HTTPS responses, including managed custom and cached locations.
• Support NPM_PUBLIC_HTTPS_PORT for installations publishing HTTPS on a different external port.
• Reserve UDP 443 transactionally and reject conflicts with Streams and detected manual QUIC listeners.
• Serialize the configuration operations needed to keep host state and the shared listener consistent, restore the listener after ACME host restoration, and preserve the current develop fix for failed .conf.err files.
• Include a dedicated migration, API definitions/examples, SSL UI and translations, Docker UDP exposure, deployment documentation, and focused tests.

HTTP/3 is disabled by default, and existing API clients can omit the new http3_support field. Existing gzip and fixed asset-cache behavior are retained. HTTPS requires both TCP and UDP port publication; custom raw Nginx configuration remains the user's responsibility as documented.

Validation

• Backend tests: 5 passed; full frontend suite: 10 passed.
• Backend/frontend lint, OpenAPI validation, locale compilation, TypeScript, and production frontend build passed.
• Fresh isolated Linux/SQLite setup: all 20 migrations passed; HTTP/3 defaults and absence of gzip/cache-TTL columns verified.
• Real Nginx checks passed for QUIC configuration, TLS-only Alt-Svc, an external port of 8443, regular/custom/cached locations, and opt-out behavior.
• The full Cypress CI stack and an end-to-end QUIC client handshake were not rerun locally; the included API scenarios cover TLS enabling and UDP 443 conflict handling.

The runtime checks used the project's nginxproxymanager/nginx-full:certbot-node image with Node 22 and its HTTP/3-enabled Nginx build.

A temporary combined checkout of all three split changes also passed 13 backend tests, 13 frontend tests, the frontend build, all 22 migrations, and the Nginx runtime checks after resolving the shared insertion points.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• API changes
• Performance improvement
• Test addition or update

AI Usage

• AI was used to write this
• AI was used to review this