Read configured_scheme/port and management_public_base; PUT domain with scheme/port only as backend expects.
Add gateway scheme/host/port with derived Base URL, certificate list plus upload/HTTP-01 dialog, soften identity https-only gate, and let OIDC guide inherit public base from readiness when available.