fix: preserve live Nginx entry when saved draft differs

backend/internal/api/identity_gateway.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"fmt"
 	"net/http"
 	"strings"
 
@@ -71,7 +72,7 @@ func (s *Server) RefreshManagedGatewayOnStart() error {
 	s.gatewayMu.Lock()
 	defer s.gatewayMu.Unlock()
 	status := tlsservice.Status()
-	if status.Mode != "nginx" || status.RestartRequired || status.Domain == "" || status.PublicBase == "" {
+	if status.Mode != "nginx" || status.RestartRequired {
 		return nil
 	}
 	scheme := status.Scheme
@@ -79,6 +80,22 @@ func (s *Server) RefreshManagedGatewayOnStart() error {
 		scheme = "https"
 	}
 	stage := nginxgateway.Stage()
+	if stage != "none" {
+		actual, err := nginxgateway.ManagedEntry()
+		if err != nil {
+			return err
+		}
+		actualBase := tlsservice.PublicBaseURL(actual.Scheme, actual.Domain, actual.Port)
+		if actualBase != status.ConfiguredPublicBase {
+			if err := tlsservice.UseManagedNginxEntry(service.BaseDir(), actual.Scheme, actual.Domain, actual.Port); err != nil {
+				return err
+			}
+			return fmt.Errorf("已保存的公网入口 %s 与运行中的 Nginx %s 不同；保留当前站点，请在设置页确认后保存", status.ConfiguredPublicBase, actualBase)
+		}
+	}
+	if status.Domain == "" || status.PublicBase == "" {
+		return nil
+	}
 	if scheme == "https" && (!status.Valid || stage != "https") {
 		return nil
 	}