fix: preserve live Nginx entry when saved draft differs

backend/internal/tlsservice/tlsservice_test.go

@@ -116,6 +116,12 @@ func TestNginxEntryCanAdoptWithoutRestart(t *testing.T) {
 	if s := Status(); s.RestartRequired || s.ConfiguredPublicBase != "http://second.example.com:8080" || s.PublicBase != s.ConfiguredPublicBase {
 		t.Fatalf("nginx config was not adopted: %+v", s)
 	}
+	if err := UseManagedNginxEntry(dir, "https", "first.example.com", 443); err != nil {
+		t.Fatal(err)
+	}
+	if s := Status(); s.PublicBase == s.ConfiguredPublicBase || s.ConfiguredPublicBase != "http://second.example.com:8080" {
+		t.Fatalf("live Nginx address must remain distinct from saved draft: %+v", s)
+	}
 }
 
 func TestPublicBaseURL(t *testing.T) {