Make Nginx the default public gateway

frontend/src/locales/en-US.json

@@ -900,7 +900,7 @@
     "domain": "Configured domain",
     "activeDomain": "Active domain",
     "saveDomain": "Save domain",
-    "restartRequired": "Gateway mode saved; switching between Go and Nginx requires restarting the management service",
+    "restartRequired": "Public entry saved; check the gateway site status",
     "siteActivationRequired": "Entry saved; prepare and enable the Nginx site below for first use",
     "pendingEntry": "Nginx still serves {address}; save to validate and apply the new entry",
     "applied": "Public entry updated; Nginx configuration is active",
@@ -917,14 +917,11 @@
     "automatic": "Automatic (autocert)",
     "ports": "HTTP / HTTPS ports",
     "externalPorts": "Managed by external Nginx; listener status not checked",
-    "setupHint": "Changes to an active Nginx gateway apply on save. Prepare a certificate for initial setup. Only switching between Go and Nginx modes requires a restart.",
+    "setupHint": "Nginx owns the public gateway. Active sites reload on save; initial HTTPS setup needs a certificate.",
     "refresh": "Refresh status",
     "openHttps": "Open HTTPS health check",
     "loadFailed": "Could not load certificate status",
-    "mode": "Public entry mode",
-    "goMode": "Go automatic certificate (binds 80/443)",
-    "nginxMode": "Nginx proxy (external 80/443)",
-    "saveMode": "Save entry mode",
+    "legacyModeHint": "This server still uses the legacy Go public listener. Migrate to Nginx using the deployment guide before editing the gateway.",
     "nginxHint": "An active Nginx gateway reloads on save. Initial setup requires enabling the site separately; the management service remains on port 18080.",
     "externalRenewal": "Managed by Certbot",
     "previewNginx": "Preview Nginx configuration",
@@ -940,13 +937,13 @@
     "siteReady": "HTTPS site and certificate are ready",
     "siteFailed": "Gateway or certificate setup failed; see output",
     "directPortWarning": "The management service still listens publicly on port 18080, bypassing Nginx path rules. Migrate clients using the old HTTP address, then bind the service to 127.0.0.1:18080.",
-    "setupTitle": "Optional HTTPS public gateway",
+    "setupTitle": "Nginx gateway and certificate",
     "setupStepCheck": "Detect system",
     "setupStepInstall": "Install dependencies",
     "setupStepConfigure": "Configure gateway and certificate",
     "detectedSystem": "Server OS",
     "setupUnsupported": "Automatic setup requires root on Ubuntu or TencentOS Server 4",
-    "setupScope": "Use only if you choose the Nginx gateway. Installs Nginx / Certbot and prepares the validation directory. It does not install VPN protocol dependencies, enable ports, or issue certificates.",
+    "setupScope": "Installs Nginx / Certbot and prepares the validation directory. It does not install VPN protocol dependencies, enable ports, or issue certificates.",
     "setupButton": "Prepare Nginx / Certbot",
     "setupComplete": "Dependencies are ready; configure the site and certificate next",
     "setupFailed": "Initialization failed; inspect the output",