Guard HTTP to HTTPS IP certificate staging

backend/internal/api/tls.go

@@ -172,6 +172,24 @@ func (s *Server) setTLSDomain(c *gin.Context) {
 			c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
 			return
 		}
+		// A plain HTTP site can stage HTTPS on the same host before a certificate
+		// exists. The explicit activation action sets up HTTP-01, issues the
+		// certificate and only then replaces the live site.
+		if actual.Scheme == "http" && scheme == "https" && actual.Domain == strings.ToLower(strings.TrimSpace(req.Domain)) && !nginxgateway.CertificateReady(actual.Domain) {
+			if !tlsservice.ValidDomain(actual.Domain) {
+				if err := nginxgateway.CheckIPCertificateSupport(actual.Domain); err != nil {
+					c.JSON(http.StatusPreconditionFailed, gin.H{"error": err.Error()})
+					return
+				}
+			}
+			if err := tlsservice.ConfigurePublicEntry(service.BaseDir(), scheme, req.Domain, port); err != nil {
+				c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+				return
+			}
+			store.Audit(c.GetString("username"), "tls_domain_staged", newBase, "待签发证书并启用 HTTPS")
+			c.JSON(http.StatusOK, gin.H{"status": tlsservice.Status(), "site_activation_required": true})
+			return
+		}
 		authPort, err := authGatewayPort(newBase)
 		if err != nil {
 			c.JSON(http.StatusConflict, gin.H{"error": err.Error()})