feat(frontend): public entry scheme/port and certificate dialog

Add gateway scheme/host/port with derived Base URL, certificate list
plus upload/HTTP-01 dialog, soften identity https-only gate, and let
OIDC guide inherit public base from readiness when available.

frontend/src/locales/en-US.json

@@ -52,7 +52,8 @@
     "never": "Never",
     "copiedToClipboard": "Copied to clipboard",
     "logout": "Logout",
-    "batchOperation": "Batch Operation"
+    "batchOperation": "Batch Operation",
+    "copyFailed": "Copy failed"
   },
   "login": {
     "title": "VPN Management Platform",
@@ -630,9 +631,9 @@
     "tenantFailed": "Enterprise permission check failed",
     "tenantNotEnabled": "",
     "enabled": "Enable built-in issuer",
-    "httpsOnly": "Use HTTPS to enter app credentials.",
+    "httpsOnly": "You are on HTTP. You can still configure identity; prefer the HTTPS public Base URL in production.",
     "openHttps": "Open HTTPS management site",
-    "httpsRequired": "Configure and activate your public HTTPS site and certificate first.",
+    "httpsRequired": "Built-in issuer needs a configured public entry; HTTP is allowed when scheme/port are set.",
     "gatewayPending": "The identity provider is saved but Nginx does not yet route /id/; sync the gateway.",
     "addresses": "Addresses and client credentials",
     "issuer": "OIDC issuer",
@@ -939,7 +940,39 @@
     "hostRoute": "Default route",
     "hostForward": "IPv4 forwarding",
     "enableForwarding": "Enable IPv4 forwarding",
-    "forwardingEnabled": "IPv4 forwarding enabled"
+    "forwardingEnabled": "IPv4 forwarding enabled",
+    "publicEntryTitle": "Public entry",
+    "publicEntryDesc": "Scheme, host, and port define the public Base URL used by the OIDC issuer, Feishu identity, and tunnel callbacks.",
+    "scheme": "Scheme",
+    "host": "Host",
+    "port": "Port",
+    "publicBase": "Public Base URL",
+    "publicBaseHint": "OIDC issuer is Base URL + /id; tunnel callbacks inherit the same base.",
+    "httpRisk": "HTTP is plaintext. Prefer HTTPS in production; HTTP is for intranet or temporary ICP workarounds.",
+    "saveEntry": "Save public entry",
+    "hostRequired": "Host is required",
+    "certListTitle": "Certificates",
+    "addCert": "Add certificate",
+    "replaceCert": "Replace",
+    "certSource": "Source",
+    "sourceUpload": "Upload",
+    "sourceHttp01": "HTTP-01",
+    "noCerts": "No certificates yet",
+    "renewalFailed": "Renewal failed",
+    "methodUpload": "Upload existing certificate",
+    "methodHttp01": "Request free certificate",
+    "certPem": "Certificate",
+    "keyPem": "Private key",
+    "certPemPlaceholder": "Paste PEM certificate or upload .crt / .pem",
+    "keyPemPlaceholder": "Paste PEM private key or upload .key",
+    "uploadCertFile": "Upload certificate file (.crt)",
+    "uploadKeyFile": "Upload private key file (.key)",
+    "applyEmail": "Email",
+    "multiDomainHint": "Domain name",
+    "http01Hint": "Let’s Encrypt HTTP-01. Port 80 must be reachable. Auto-renewal status appears in the list.",
+    "certKeyRequired": "Certificate and private key are required",
+    "certUploaded": "Certificate uploaded",
+    "uploadApiPending": "Upload API is not ready yet (POST /system/tls/certificate). Use HTTP-01 for now."
   },
   "feishuSync": {
     "title": "Feishu directory",