Sync OpenVPN OAuth gateway routes on tunnel changes

backend/internal/api/identity_gateway.go

@@ -46,6 +46,8 @@ func (*gatewayConflict) Error() string {
 // with the binary after upgrades. It only touches this application's managed
 // Nginx site; RefreshAuth validates it and rolls back on failed reloads.
 func (s *Server) RefreshManagedGatewayOnStart() error {
+	s.gatewayMu.Lock()
+	defer s.gatewayMu.Unlock()
 	status := tlsservice.Status()
 	if !status.Valid || status.Mode != "nginx" || status.RestartRequired || nginxgateway.Stage() != "https" {
 		return nil
@@ -57,7 +59,16 @@ func (s *Server) RefreshManagedGatewayOnStart() error {
 	return nginxgateway.RefreshAuth(status.Domain, s.router.Routes(), port)
 }
 
+func (s *Server) syncAuthGatewayForTunnel(t *model.Tunnel) error {
+	if t.Protocol != "openvpn" || s.router == nil {
+		return nil
+	}
+	return s.RefreshManagedGatewayOnStart()
+}
+
 func (s *Server) identityGateway(c *gin.Context) {
+	s.gatewayMu.Lock()
+	defer s.gatewayMu.Unlock()
 	status := tlsservice.Status()
 	if !status.Valid || status.Mode != "nginx" || status.RestartRequired || nginxgateway.Stage() != "https" {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "请先完成 Nginx HTTPS 入口配置"})