Refactor nginx to path-based domain model with config migration

Replace the legacy top-level management key with a unified paths-based
model. Each domain now contains a paths map where each entry defines its
own backend, auth, headers, and flags (is_management, is_websocket).

- Add _migrate_config() to auto-migrate legacy formats on first load
- Remove set_management_proxy() and POST_NGINX_MANAGEMENT endpoint
- Update server_block.conf template to iterate paths with per-location auth
- Update daemon handler, API blueprint, state collector, and install script
- Add server config generation tests for paths, WebSocket, auth inheritance
- Update frontend proxy page to display per-path rows with flags

install.sh

@@ -365,7 +365,7 @@ else
     "${PROJECT_DIR}/.venv/bin/python3" -c "
 import daemon.client as c
 from daemon.iface import (
-    POST_ACME_SELF_SIGNED, POST_NGINX_MANAGEMENT, POST_NGINX_APPLY,
+    POST_ACME_SELF_SIGNED, POST_NGINX_DOMAINS_ADD, POST_NGINX_APPLY,
     POST_FIREWALL_CONFIG, POST_FIREWALL_CONFIG_APPLY, POST_NETWORK_SYSCTL_SET,
     GET_NETWORK_INFER_DHCP_RANGES,
 )
@@ -384,12 +384,20 @@ try:
 except Exception as e:
     print(f'  [cert] Warning: {e}', file=sys.stderr)
 
-# Management proxy + htpasswd
+# Management proxy domain + htpasswd
 try:
-    c.post(POST_NGINX_MANAGEMENT, {
+    c.post(POST_NGINX_DOMAINS_ADD, {
         'domain': domain,
-        'flask_host': '127.0.0.1',
-        'flask_port': 9090,
+        'paths': {
+            '/': {
+                'backend': {'host': '127.0.0.1', 'port': 9090, 'proto': 'http'},
+                'is_management': True,
+            },
+            '/ws': {
+                'backend': {'host': '127.0.0.1', 'port': 9091, 'proto': 'http'},
+                'is_websocket': True,
+            },
+        },
         'auth_user': mgmt_user,
         'auth_pass': mgmt_pass,
     })