fix: preserve live Nginx entry when saved draft differs

backend/internal/api/tls.go

@@ -176,6 +176,11 @@ func (s *Server) setTLSDomain(c *gin.Context) {
 	if status.Mode == "nginx" && status.ConfiguredMode == "nginx" && nginxgateway.Stage() != "none" {
 		s.gatewayMu.Lock()
 		defer s.gatewayMu.Unlock()
+		actual, err := nginxgateway.ManagedEntry()
+		if err != nil {
+			c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
+			return
+		}
 		if err := checkAuthGatewayChange(status.PublicBase, newBase); err != nil {
 			c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
 			return
@@ -186,7 +191,7 @@ func (s *Server) setTLSDomain(c *gin.Context) {
 			return
 		}
 		opts := nginxconfig.RenderOptions{Domain: req.Domain, Scheme: scheme, Port: port}
-		err = nginxgateway.UpdateEntry(opts, status.ConfiguredDomain, s.router.Routes(), authPort, func() error {
+		err = nginxgateway.UpdateEntry(opts, actual.Domain, s.router.Routes(), authPort, func() error {
 			if err := tlsservice.ConfigurePublicEntry(service.BaseDir(), scheme, req.Domain, port); err != nil {
 				return err
 			}