fix(frontend): align gateway fields with public_base API

Read configured_scheme/port and management_public_base; PUT domain
with scheme/port only as backend expects.

frontend/src/components/OpenVPNOIDCGuide.vue

@@ -133,14 +133,11 @@ async function loadReadiness() {
 }
 const suggestedBaseUrl = computed(() => {
   const status = readiness.value
-  if (status?.public_base_url) return String(status.public_base_url).replace(/\/+$/, '')
+  if (status?.management_public_base) return String(status.management_public_base).replace(/\/+$/, '')
+  if (status?.public_base) return String(status.public_base).replace(/\/+$/, '')
   const domain = status?.management_domain || ''
   if (!/^[a-z0-9.-]+$/i.test(domain)) return ''
-  const scheme = status?.management_scheme === 'http' ? 'http' : 'https'
-  const port = Number(status?.management_port)
-  const def = scheme === 'http' ? 80 : 443
-  const portPart = Number.isFinite(port) && port > 0 && port !== def ? `:${port}` : ''
-  return `${scheme}://${domain}${portPart}`
+  return `https://${domain}`
 })
 async function requestPort(from, direction, previous = null) {
   portLoading.value = true

frontend/src/views/settings/components/GatewaySettings.vue

@@ -211,7 +211,12 @@ const certForm = reactive({
   email: '',
 })
 
-const publicBase = computed(() => buildPublicBase(entry))
+const publicBase = computed(() => {
+  const local = buildPublicBase(entry)
+  const remote = tlsStatus.value?.configured_public_base || tlsStatus.value?.public_base || ''
+  // Prefer live form preview while editing; fall back to server after load.
+  return local || remote
+})
 
 const certRows = computed(() => {
   const s = tlsStatus.value
@@ -325,8 +330,10 @@ async function loadTLS() {
     const { data } = await api.get('/system/tls')
     tlsStatus.value = data
     entry.host = data.configured_domain || data.domain || data.host || ''
-    entry.scheme = data.scheme === 'http' ? 'http' : 'https'
-    entry.port = Number(data.port) > 0 ? Number(data.port) : defaultPort(entry.scheme)
+    const scheme = data.configured_scheme || data.scheme || 'https'
+    entry.scheme = scheme === 'http' ? 'http' : 'https'
+    const port = Number(data.configured_port || data.port)
+    entry.port = port > 0 ? port : defaultPort(entry.scheme)
     entry.mode = data.configured_mode || data.mode || 'autocert'
   } catch (e) { ElMessage.error(e.response?.data?.error || t('tls.loadFailed')) }
   finally { tlsLoading.value = false }
@@ -336,10 +343,8 @@ async function savePublicEntry() {
   if (!entry.host) return ElMessage.warning(t('tls.hostRequired'))
   tlsSaving.value = true
   try {
-    // Forward-compatible: backend may only honor domain until scheme/port land.
     const { data: domainRes } = await api.put('/system/tls/domain', {
       domain: entry.host,
-      host: entry.host,
       scheme: entry.scheme,
       port: entry.port,
     })
@@ -417,7 +422,7 @@ async function submitCert() {
     if (!host) return ElMessage.warning(t('tls.hostRequired'))
     entry.host = host.split(/[\s,]+/)[0]
     await api.put('/system/tls/domain', {
-      domain: entry.host, host: entry.host, scheme: entry.scheme, port: entry.port,
+      domain: entry.host, scheme: entry.scheme, port: entry.port,
     })
     if (entry.mode !== 'nginx') {
       await api.put('/system/tls/mode', { mode: 'nginx' })