fix: apply managed Nginx public entry without service restart

backend/internal/api/identity_gateway_test.go

@@ -29,6 +29,12 @@ func TestAuthGatewayPortFollowsRunningOIDCTunnel(t *testing.T) {
 		t.Fatal(err)
 	}
 	check(19090)
+	if err := checkAuthGatewayChange("https://vpn.example.com", "http://vpn.example.com"); err == nil {
+		t.Fatal("active OIDC callback must block public entry change")
+	}
+	if err := checkAuthGatewayChange("https://vpn.example.com", "https://vpn.example.com"); err != nil {
+		t.Fatalf("unchanged public entry should be allowed: %v", err)
+	}
 	if port, err := authGatewayPort("https://other.example.com"); err != nil || port != 0 {
 		t.Fatalf("wrong domain routed: %d, %v", port, err)
 	}
@@ -36,4 +42,7 @@ func TestAuthGatewayPortFollowsRunningOIDCTunnel(t *testing.T) {
 		t.Fatal(err)
 	}
 	check(0)
+	if err := checkAuthGatewayChange("https://vpn.example.com", "http://vpn.example.com"); err != nil {
+		t.Fatalf("stopped OIDC tunnel should allow change: %v", err)
+	}
 }