Add managed Nginx HTTP-01 gateway activation and certificate status

backend/cmd/opsx-gateway-setup/main.go

@@ -0,0 +1,17 @@
+// opsx-gateway-setup prepares Nginx and Certbot without enabling a default
+// public site. The management UI invokes the same guarded installer.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"vpn-platform/backend/internal/nginxsetup"
+)
+
+func main() {
+	if err := nginxsetup.Run(func(message string) { fmt.Print(message) }); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}