feat: auto-generate self-signed certs, hoover modal processing guard, refactor backends/proxy pages

scripts/install.sh

@@ -376,29 +376,24 @@ else
         fi
     }
 
-    # 1A. Self-signed certificate
+    # 1A. Self-signed certificate for management domain
     _daemon_post "/acme/self-signed" "{\"domain\":\"$DOMAIN\"}" "Self-signed certificate"
 
-    # 1C. Management proxy domain
-    _daemon_post "/nginx/domains/add" "$(jq -n \
+    # 1C. Management proxy domain — try idempotent update first, fall back to add
+    local mgmt_json
+    mgmt_json="$(jq -n \
       --arg domain "$DOMAIN" \
       --arg user "$MGMT_USER" \
       --arg pass "$MGMT_PASS" \
       '{
         domain: $domain,
-        paths: {
-          "/": {
-            backend: {host: "127.0.0.1", port: 9090, proto: "http"},
-            is_management: true
-          },
-          "/ws": {
-            backend: {host: "127.0.0.1", port: 9091, proto: "http"},
-            is_websocket: true
-          }
-        },
-        auth_user: $user,
-        auth_pass: $pass
-      }')" "Management domain configured"
+        backend: "webui",
+        cert: "selfsigned",
+        force_ssl: true,
+        auth: {user: $user, pass: $pass}
+      }')"
+    _daemon_post "/nginx/domains/update" "$mgmt_json" "Management domain configured" || \
+      _daemon_post "/nginx/domains/add" "$mgmt_json" "Management domain configured"
 
     _daemon_post "/nginx/apply" "{}" "Nginx config applied"