fix: apply managed Nginx public entry without service restart

backend/internal/tlsservice/tlsservice.go

@@ -282,6 +282,25 @@ func ConfigureMode(dataDir, mode string) error {
 	return writePersisted(dataDir, "tls-mode", mode)
 }
 
+// AdoptNginxConfiguration updates the in-process public address after the
+// managed Nginx site has passed validation and reloaded successfully.
+func AdoptNginxConfiguration(dataDir string) error {
+	config, err := configFromEnvironment(dataDir)
+	if err != nil {
+		return err
+	}
+	if config.mode != "nginx" {
+		return fmt.Errorf("当前入口不是 Nginx 模式")
+	}
+	state.Lock()
+	defer state.Unlock()
+	if state.config.mode != "nginx" || state.config.dataDir != dataDir {
+		return fmt.Errorf("运行模式不支持热更新 Nginx 入口")
+	}
+	state.config = config
+	return nil
+}
+
 // Start keeps certificates in the persistent data directory. Issuance occurs
 // on the first TLS handshake, and autocert handles renewal.
 func Start(handler http.Handler, dataDir string) error {
@@ -377,8 +396,8 @@ func Status() CertificateStatus {
 		status.ConfiguredScheme = normalizeScheme(desired.scheme)
 		status.ConfiguredPort = desired.port
 		status.ConfiguredPublicBase = PublicBaseURL(status.ConfiguredScheme, desired.domain, desired.port)
-		status.RestartRequired = desired.domain != config.domain || desired.mode != config.mode ||
-			normalizeScheme(desired.scheme) != scheme || desired.port != config.port
+		status.RestartRequired = desired.mode != config.mode || (config.mode != "nginx" &&
+			(desired.domain != config.domain || normalizeScheme(desired.scheme) != scheme || desired.port != config.port))
 	}
 	if config.mode == "nginx" {
 		// Certbot or uploaded PEMs own HTTPS certificates. HTTP needs no leaf.