fix: preserve live Nginx entry when saved draft differs

backend/internal/tlsservice/tlsservice.go

@@ -301,6 +301,21 @@ func AdoptNginxConfiguration(dataDir string) error {
 	return nil
 }
 
+// UseManagedNginxEntry keeps the in-process identity issuer aligned with the
+// live Nginx site if an older version left an unapplied draft on disk.
+func UseManagedNginxEntry(dataDir, scheme, domain string, port int) error {
+	if !ValidScheme(scheme) || !ValidDomain(domain) || port < 1 || port > 65535 {
+		return fmt.Errorf("运行中的 Nginx 公网地址无效")
+	}
+	state.Lock()
+	defer state.Unlock()
+	if state.config.mode != "nginx" || state.config.dataDir != dataDir {
+		return fmt.Errorf("当前运行模式不是 Nginx")
+	}
+	state.config.scheme, state.config.domain, state.config.port = scheme, domain, port
+	return nil
+}
+
 // Start keeps certificates in the persistent data directory. Issuance occurs
 // on the first TLS handshake, and autocert handles renewal.
 func Start(handler http.Handler, dataDir string) error {