feat: add self-hosted PWA backend runtime (#944)

* feat(web-backend): add self-hosted proxy app

* feat(web): enable runtime PWA configuration

* test(web-e2e): cover self-hosted backend proxy

* test(web-e2e): clean self-hosted lint warnings

* fix(web-backend): validate proxied provider URLs

* fix(web-backend): proxy through registered provider targets

* fix(web-backend): document CodeQL SSRF validation boundary

* test(web-e2e): mock provider target registration

* fix(web): address self-hosted review feedback

apps/web-backend/project.json

@@ -0,0 +1,49 @@
+{
+    "name": "web-backend",
+    "$schema": "../../node_modules/nx/schemas/project-schema.json",
+    "projectType": "application",
+    "sourceRoot": "apps/web-backend/src",
+    "tags": ["scope:app", "domain:web", "type:app"],
+    "targets": {
+        "build": {
+            "executor": "@nx/esbuild:esbuild",
+            "outputs": ["{options.outputPath}"],
+            "options": {
+                "outputPath": "dist/apps/web-backend",
+                "main": "apps/web-backend/src/main.ts",
+                "tsConfig": "apps/web-backend/tsconfig.app.json",
+                "format": ["cjs"],
+                "platform": "node",
+                "target": "node22",
+                "bundle": true,
+                "thirdParty": true,
+                "generatePackageJson": true
+            }
+        },
+        "serve": {
+            "continuous": true,
+            "executor": "nx:run-commands",
+            "options": {
+                "command": "pnpm tsx apps/web-backend/src/main.ts",
+                "cwd": "{workspaceRoot}",
+                "color": true,
+                "env": {
+                    "PORT": "3333",
+                    "CLIENT_URL": "http://localhost:4200",
+                    "BACKEND_URL": "/api",
+                    "IPTVNATOR_PROXY_ALLOW_PRIVATE_NETWORKS": "1"
+                }
+            }
+        },
+        "lint": {
+            "command": "eslint apps/web-backend/**/*.ts"
+        },
+        "test": {
+            "executor": "@nx/jest:jest",
+            "outputs": ["{workspaceRoot}/coverage/{projectRoot}"],
+            "options": {
+                "jestConfig": "apps/web-backend/jest.config.ts"
+            }
+        }
+    }
+}