fix(lxc): preserve credentials and IP across reinstall

Three related fixes so login/password/SSH key/IP survive a reinstall:

1. backend/app/api/proxmox/lxc.py — on initial LXC deploy save
   cloud_init_user='root' and cloud_init_password=req.password to VMInstance
   (previously both were None, so reinstall could not restore root password).

2. backend/app/api/proxmox/async_ops.py — _do_reinstall_sync passes
   cached.cloud_init_password to create_lxc_container so the new container
   gets the same root password as the original.

3. backend/app/workers/monitoring_worker.py — VM sync worker no longer
   overwrites VMInstance.ip_address with NULL when no IPAM allocation
   exists for that (server_id, vmid). It only updates the field when
   IPAM has a value, otherwise the IP saved at deploy/wizard time is
   preserved.

nginx/conf.d/pvemanager.conf

@@ -0,0 +1,82 @@
+# NGINX Configuration Template for Server Panel (HTTP only, no SSL)
+# Replace pve.cloudly.uz with your actual domain or server IP
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name pve.cloudly.uz;
+
+    # Logging
+    access_log /var/log/nginx/pvemanager_access.log;
+    error_log /var/log/nginx/pvemanager_error.log;
+
+    # Let's Encrypt challenge (needed for SSL certificate obtaining)
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+        try_files $uri =404;
+    }
+
+    # Rate limiting
+    limit_req zone=general burst=20 nodelay;
+    limit_conn addr 10;
+
+    # Health check endpoint
+    location /health {
+        proxy_pass http://pvemanager-app:8000;
+        access_log off;
+    }
+
+    # API proxy
+    location /api/ {
+        limit_req zone=api burst=50 nodelay;
+        proxy_pass http://pvemanager-app:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Proxmox API proxy
+    location /proxmox/ {
+        proxy_pass http://pvemanager-app:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 60s;
+    }
+
+    # WebSocket support — tasks и terminal
+    location ~ ^/(ws|proxmox/ws)/ {
+        proxy_pass http://pvemanager-app:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 86400;
+        proxy_send_timeout 86400;
+    }
+
+    # Backend static files (legacy, logo, etc.)
+    location /static/ {
+        proxy_pass http://pvemanager-app:8000;
+        proxy_cache_valid 200 1d;
+        expires 1d;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # SPA frontend — all other routes
+    location / {
+        proxy_pass http://pvemanager-frontend:80;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}