Refactor nginx to path-based domain model with config migration

Replace the legacy top-level management key with a unified paths-based
model. Each domain now contains a paths map where each entry defines its
own backend, auth, headers, and flags (is_management, is_websocket).

- Add _migrate_config() to auto-migrate legacy formats on first load
- Remove set_management_proxy() and POST_NGINX_MANAGEMENT endpoint
- Update server_block.conf template to iterate paths with per-location auth
- Update daemon handler, API blueprint, state collector, and install script
- Add server config generation tests for paths, WebSocket, auth inheritance
- Update frontend proxy page to display per-path rows with flags

tests/test_handler_acme.py

@@ -351,7 +351,9 @@ class TestCheckDnsPublic:
             returncode=0, stdout="example.com has address 52.14.150.110"
         )
         with (
-            patch("daemon.handlers.acme._get_local_ips", return_value={"52.14.150.110"}),
+            patch(
+                "daemon.handlers.acme._get_local_ips", return_value={"52.14.150.110"}
+            ),
             patch("subprocess.run", return_value=mock_result),
         ):
             passed, _ = _check_dns_public("example.com")