web: update htmx, daisyui

refactor(proxymanager): replace newPortProxy positional params with s…

…truct

docs: add SSH tunnel configuration to v3 docs

Documents ssh:// scheme support, auth options (private key with
optional passphrase, SSH agent), host key verification, and example
configs for remote Docker daemon access.

fix(proxymanager): show proxies in dashboard during Tailscale auth

When no authkey is configured, newAndStartProxy() called Start() before
adding the proxy to the map. For HTTPS (the default), Start() calls
tsnet.ListenTLS which blocks until the node reaches Running state.
Since the node stays in NeedsLogin without an authkey, the proxy was
never added to the map and never appeared in the dashboard.

Fix by inserting the proxy into the map before Start(), so the dashboard
card appears immediately. Split Start() into startProvider() (quick,
under opMu) and startListeners() (may block, opMu released) to prevent
deadlock when Close() runs concurrently (e.g. container stops while
auth is pending).

Closes #461

Release v2.3.2

Fixes:
- Fix Docker and List providers ignoring proxyAccessLog: false server config
- Fix CI releases not marked as latest on GitHub

Closes #457

Release v2.3.1

Bug fixes:
- Auto-enable adminAllowLocalhost when running inside Docker containers
- Improve 403 forbidden page with actionable resolution steps

Fixes #455