fix: apply managed Nginx public entry without service restart

frontend/src/locales/en-US.json

@@ -900,21 +900,23 @@
     "domain": "Configured domain",
     "activeDomain": "Active domain",
     "saveDomain": "Save domain",
-    "restartRequired": "Domain saved; restart OpsX VPN to enable ports 80/443 and automatic issuance",
+    "restartRequired": "Gateway mode saved; switching between Go and Nginx requires restarting the management service",
+    "siteActivationRequired": "Entry saved; prepare and enable the Nginx site below for first use",
+    "applied": "Public entry updated; Nginx configuration is active",
     "saveFailed": "Could not save domain",
     "dns": "DNS",
     "certificate": "Certificate",
     "valid": "Valid",
     "pending": "Pending first HTTPS handshake",
     "notConfigured": "Disabled",
-    "saved": "Domain configuration saved",
+    "saved": "Public entry saved",
     "issuer": "Issuer",
     "expires": "Expires",
     "renewal": "Renewal",
     "automatic": "Automatic (autocert)",
     "ports": "HTTP / HTTPS ports",
     "externalPorts": "Managed by external Nginx; listener status not checked",
-    "setupHint": "Restart to apply a saved domain or mode. Before switching to Nginx, follow the deployment guide to install it, issue a certificate, and validate the configuration. Go mode caches certificates in data/acme; saving settings alone does not issue a certificate.",
+    "setupHint": "Changes to an active Nginx gateway apply on save. Prepare a certificate for initial setup. Only switching between Go and Nginx modes requires a restart.",
     "refresh": "Refresh status",
     "openHttps": "Open HTTPS health check",
     "loadFailed": "Could not load certificate status",
@@ -922,7 +924,7 @@
     "goMode": "Go automatic certificate (binds 80/443)",
     "nginxMode": "Nginx proxy (external 80/443)",
     "saveMode": "Save entry mode",
-    "nginxHint": "Save the Nginx mode and domain, restart the service, then enable the site and request a certificate. Public ports 80/443 must be open.",
+    "nginxHint": "An active Nginx gateway reloads on save. Initial setup requires enabling the site separately; the management service remains on port 18080.",
     "externalRenewal": "Managed by Certbot",
     "previewNginx": "Preview Nginx configuration",
     "previewOnly": "Configuration preview; HTTP handles issuance and HTTPS starts after the certificate exists.",

frontend/src/locales/zh-CN.json

@@ -900,21 +900,23 @@
     "domain": "配置域名",
     "activeDomain": "当前监听域名",
     "saveDomain": "保存域名",
-    "restartRequired": "域名已保存，重启 opsx-vpn 后才会监听 80/443 并启用自动签发",
+    "restartRequired": "入口模式已保存；切换 Go 与 Nginx 模式需重启管理服务",
+    "siteActivationRequired": "入口已保存；首次启用站点请到下方准备并启用 Nginx",
+    "applied": "公网入口已更新，Nginx 配置已生效",
     "saveFailed": "保存域名失败",
     "dns": "DNS 解析",
     "certificate": "证书",
     "valid": "有效",
     "pending": "等待首次 HTTPS 请求签发",
     "notConfigured": "未启用",
-    "saved": "域名配置已保存",
+    "saved": "公网入口已保存",
     "issuer": "颁发者",
     "expires": "到期时间",
     "renewal": "续签",
     "automatic": "自动（autocert）",
     "ports": "HTTP / HTTPS 端口",
     "externalPorts": "由外部 Nginx 管理，尚未检测监听状态",
-    "setupHint": "保存域名或入口模式后需重启生效；切换为 Nginx 前须按部署文档完成安装、证书签发和配置校验。Go 模式证书缓存于 data/acme；保存配置本身不会签发证书。",
+    "setupHint": "已启用的 Nginx 入口保存后立即生效；首次启用站点需准备证书。只有切换 Go 与 Nginx 模式才需重启。",
     "refresh": "刷新状态",
     "openHttps": "打开 HTTPS 健康检查",
     "loadFailed": "读取证书状态失败",
@@ -922,7 +924,7 @@
     "goMode": "Go 自动证书（进程监听 80/443）",
     "nginxMode": "Nginx 代理（外部监听 80/443）",
     "saveMode": "保存入口模式",
-    "nginxHint": "选择 Nginx 模式并保存域名后重启服务，再点击启用站点申请证书。端口 80/443 需允许公网访问。",
+    "nginxHint": "已启用的 Nginx 入口保存后立即重载；首次配置需单独启用站点。管理服务继续监听 18080。",
     "externalRenewal": "由 Certbot 管理",
     "previewNginx": "预览 Nginx 配置",
     "previewOnly": "以下为配置预览；HTTP 站点用于签发，HTTPS 站点在证书存在后启用。",

frontend/src/views/settings/components/GatewaySettings.vue

@@ -54,6 +54,7 @@
       </el-form>
 
       <el-alert v-if="tlsStatus?.restart_required" type="warning" :closable="false" :title="$t('tls.restartRequired')" style="margin-top:12px" />
+      <el-alert v-else-if="entry.mode === 'nginx' && nginxSetup?.site_stage === 'none' && tlsStatus?.configured_domain" type="info" :closable="false" :title="$t('tls.siteActivationRequired')" style="margin-top:12px" />
       <el-alert v-if="tlsStatus?.management_direct_public" type="warning" :closable="false" :title="$t('tls.directPortWarning')" style="margin-top:12px" />
     </el-card>
 
@@ -383,16 +384,22 @@ async function savePublicEntry() {
   if (!entry.host) return ElMessage.warning(t('tls.hostRequired'))
   tlsSaving.value = true
   try {
+    let modeRes = null
+    if (entry.mode !== tlsStatus.value?.configured_mode) {
+      const result = await api.put('/system/tls/mode', { mode: entry.mode })
+      modeRes = result.data
+    }
     const { data: domainRes } = await api.put('/system/tls/domain', {
       domain: entry.host,
       scheme: entry.scheme,
       port: entry.port,
     })
     tlsStatus.value = domainRes.status
-    const { data: modeRes } = await api.put('/system/tls/mode', { mode: entry.mode })
-    tlsStatus.value = modeRes.status || domainRes.status
     nginxPreview.value = null
-    ElMessage.success((domainRes.restart_required || modeRes.restart_required) ? t('tls.restartRequired') : t('tls.saved'))
+    if (domainRes.restart_required || modeRes?.restart_required) ElMessage.success(t('tls.restartRequired'))
+    else if (domainRes.site_activation_required) ElMessage.success(t('tls.siteActivationRequired'))
+    else ElMessage.success(t(domainRes.applied ? 'tls.applied' : 'tls.saved'))
+    await refreshAll()
   } catch (e) { ElMessage.error(e.response?.data?.error || t('tls.saveFailed')) }
   finally { tlsSaving.value = false }
 }