Make Nginx the default public gateway

backend/internal/tlsservice/tlsservice.go

@@ -174,7 +174,7 @@ func configFromEnvironment(dataDir string) (configuration, error) {
 		mode = raw
 	}
 	if mode == "" {
-		mode = "autocert"
+		mode = "nginx"
 	}
 	if mode != "autocert" && mode != "nginx" {
 		return configuration{}, fmt.Errorf("VPN_TLS_MODE 仅支持 autocert 或 nginx")