Auth page: pure-PHP Authelia ACL parser, NPM-sourced certs tab, watchdog JS fixes, rsync settings layout

- Replace python3/PyYAML Authelia ACL parser with pure PHP (no deps available on Unraid)
- Cert tab now pulls live from NPM API instead of cert_monitor.sh — auto-discovers all managed certs sorted by urgency
- Watchdog page: add missing GB constant and _fmtBytes/_relTime functions that were causing silent render failure
- Rsync settings card: pin to far-right 3 columns (grid-column:6/-1), toggle grid narrowed to 2 columns
- Add CLAUDE.md project context file on /boot for session persistence across reboots
- claude_startup.sh: symlink CLAUDE.md into /root on array start

Plugin/unraid/api/cert.php

@@ -1,6 +1,7 @@
 <?php
 header('Content-Type: application/json');
 require_once dirname(__DIR__) . '/include/config.php';
+require_once dirname(__DIR__) . '/include/auth.php';
 
 $action = ($_SERVER['REQUEST_METHOD'] === 'POST')
     ? trim($_POST['action'] ?? '')
@@ -8,6 +9,43 @@ $action = ($_SERVER['REQUEST_METHOD'] === 'POST')
 
 $cacheFile = STATE_DIR . '/cert_status.json';
 
+// ── Live NPM cert list ────────────────────────────────────────────────────────
+if ($action === 'npm') {
+    $raw = vv_npm_req('GET', '/api/nginx/certificates');
+    if (!is_array($raw) || isset($raw['_err']))
+        die(json_encode(['ok' => false, 'error' => $raw['_err'] ?? 'NPM request failed']));
+
+    $master = vv_read_conf_raw('master.conf');
+    preg_match('/^\s*CERT_WARN_DAYS\s*=\s*(\d+)/m', $master, $w);
+    preg_match('/^\s*CERT_CRIT_DAYS\s*=\s*(\d+)/m', $master, $c);
+    $warn = (int)($w[1] ?? 30);
+    $crit = (int)($c[1] ?? 7);
+    $now  = time();
+
+    $certs = [];
+    foreach ($raw as $cert) {
+        $exp    = !empty($cert['expires_on']) ? strtotime($cert['expires_on']) : false;
+        $days   = $exp !== false ? (int)(($exp - $now) / 86400) : null;
+        $status = $days === null ? 'UNKN'
+                : ($days < 0    ? 'CRIT'
+                : ($days <= $crit ? 'CRIT'
+                : ($days <= $warn ? 'WARN' : 'OK')));
+        $certs[] = [
+            'id'          => $cert['id'],
+            'nice_name'   => $cert['nice_name'] ?? implode(', ', $cert['domain_names'] ?? []),
+            'domain_names'=> $cert['domain_names'] ?? [],
+            'provider'    => $cert['provider'] ?? 'unknown',
+            'expires'     => !empty($cert['expires_on']) ? substr($cert['expires_on'], 0, 10) : '',
+            'days'        => $days,
+            'status'      => $status,
+        ];
+    }
+    usort($certs, fn($a, $b) => ($a['days'] ?? PHP_INT_MAX) <=> ($b['days'] ?? PHP_INT_MAX));
+
+    echo json_encode(['ok' => true, 'certs' => $certs, 'warn_days' => $warn, 'crit_days' => $crit]);
+    exit;
+}
+
 // ── Read configured domains (without running checks) ─────────────────────────
 if ($action === 'domains') {
     $hostId   = vv_detect_host();