Sync managed gateway routes on startup and fix layout initialization

backend/internal/api/identity_gateway.go

@@ -42,6 +42,21 @@ func (*gatewayConflict) Error() string {
 	return "当前域名存在多条运行中的 OIDC 专线，请先保留一条"
 }
 
+// RefreshManagedGatewayOnStart keeps the installed route allowlist in sync
+// with the binary after upgrades. It only touches this application's managed
+// Nginx site; RefreshAuth validates it and rolls back on failed reloads.
+func (s *Server) RefreshManagedGatewayOnStart() error {
+	status := tlsservice.Status()
+	if !status.Valid || status.Mode != "nginx" || status.RestartRequired || nginxgateway.Stage() != "https" {
+		return nil
+	}
+	port, err := authGatewayPort(status.Domain)
+	if err != nil {
+		return err
+	}
+	return nginxgateway.RefreshAuth(status.Domain, s.router.Routes(), port)
+}
+
 func (s *Server) identityGateway(c *gin.Context) {
 	status := tlsservice.Status()
 	if !status.Valid || status.Mode != "nginx" || status.RestartRequired || nginxgateway.Stage() != "https" {