Sync managed gateway routes on startup and fix layout initialization

backend/internal/api/identity_gateway.go

@@ -42,6 +42,21 @@ func (*gatewayConflict) Error() string {
 	return "当前域名存在多条运行中的 OIDC 专线，请先保留一条"
 }
 
+// RefreshManagedGatewayOnStart keeps the installed route allowlist in sync
+// with the binary after upgrades. It only touches this application's managed
+// Nginx site; RefreshAuth validates it and rolls back on failed reloads.
+func (s *Server) RefreshManagedGatewayOnStart() error {
+	status := tlsservice.Status()
+	if !status.Valid || status.Mode != "nginx" || status.RestartRequired || nginxgateway.Stage() != "https" {
+		return nil
+	}
+	port, err := authGatewayPort(status.Domain)
+	if err != nil {
+		return err
+	}
+	return nginxgateway.RefreshAuth(status.Domain, s.router.Routes(), port)
+}
+
 func (s *Server) identityGateway(c *gin.Context) {
 	status := tlsservice.Status()
 	if !status.Valid || status.Mode != "nginx" || status.RestartRequired || nginxgateway.Stage() != "https" {

backend/internal/nginxconfig/nginxconfig_test.go

@@ -66,11 +66,16 @@ func TestRenderRejectsInjectedDomainAndRoute(t *testing.T) {
 }
 
 func TestRenderIdentityAndSingleAuthPort(t *testing.T) {
-	_, site, err := RenderWithAuth("vpn.example.com", gin.RoutesInfo{{Method: "GET", Path: "/api/health"}}, 19090)
+	_, site, err := RenderWithAuth("vpn.example.com", gin.RoutesInfo{
+		{Method: "GET", Path: "/api/health"},
+		{Method: "PUT", Path: "/api/system/tls/domain"},
+		{Method: "PUT", Path: "/api/system/identity"},
+		{Method: "POST", Path: "/api/system/identity/gateway"},
+	}, 19090)
 	if err != nil {
 		t.Fatal(err)
 	}
-	for _, route := range []string{"location = /id/.well-known/openid-configuration", "location = /id/feishu/callback", "location = /id/token", "location ^~ /oauth2/", "proxy_pass http://127.0.0.1:19090;", "location / { return 444; }"} {
+	for _, route := range []string{"location = /id/.well-known/openid-configuration", "location = /id/feishu/callback", "location = /id/token", "location = /api/system/tls/domain", "location = /api/system/identity", "location = /api/system/identity/gateway", "location ^~ /oauth2/", "proxy_pass http://127.0.0.1:19090;", "location / { return 444; }"} {
 		if !strings.Contains(site, route) {
 			t.Errorf("identity route missing: %s", route)
 		}

backend/internal/nginxgateway/gateway.go

@@ -79,6 +79,9 @@ func RefreshAuth(domain string, routes gin.RoutesInfo, authPort int) error {
 	if err != nil {
 		return err
 	}
+	if string(previous) == httpSite+httpsSite {
+		return nil
+	}
 	if err := writeSite(httpSite + httpsSite); err != nil {
 		return err
 	}