fix(lxc): preserve credentials and IP across reinstall

Three related fixes so login/password/SSH key/IP survive a reinstall:

1. backend/app/api/proxmox/lxc.py — on initial LXC deploy save
   cloud_init_user='root' and cloud_init_password=req.password to VMInstance
   (previously both were None, so reinstall could not restore root password).

2. backend/app/api/proxmox/async_ops.py — _do_reinstall_sync passes
   cached.cloud_init_password to create_lxc_container so the new container
   gets the same root password as the original.

3. backend/app/workers/monitoring_worker.py — VM sync worker no longer
   overwrites VMInstance.ip_address with NULL when no IPAM allocation
   exists for that (server_id, vmid). It only updates the field when
   IPAM has a value, otherwise the IP saved at deploy/wizard time is
   preserved.

backend/app/api/proxmox/async_ops.py

@@ -221,6 +221,7 @@ def _do_reinstall_sync(task_id: int, server_id: int, vmid: int, node: str,
                     net0=net0,
                     nameserver=nameserver,
                     searchdomain=searchdomain,
+                    password=cached.cloud_init_password,
                     ssh_public_keys=cached.ssh_keys,
                     unprivileged=unprivileged,
                     start_after_create=False,

backend/app/api/proxmox/lxc.py

@@ -280,8 +280,8 @@ def _do_lxc_deploy(task_id: int, req: LXCDeployRequest, user_id: int, username:
             ip_address=allocated_ip,
             ip_prefix=int(network_mask),
             gateway=gateway,
-            cloud_init_user=None,
+            cloud_init_user="root",
-            cloud_init_password=None,
+            cloud_init_password=req.password,
             ssh_keys=req.ssh_keys,
             template_id=None,
             template_name=req.ostemplate,

backend/app/workers/monitoring_worker.py

@@ -737,7 +737,10 @@ class MonitoringWorker:
                         existing.os_type = os_type
                         existing.vm_type = vm_type
                         existing.is_template = bool(vm_data.get('template'))
-                        existing.ip_address = ip_address
+                        # Only overwrite ip_address if IPAM has a value;
+                        # otherwise preserve user-assigned IP from deploy/wizard
+                        if ip_address:
+                            existing.ip_address = ip_address
                         existing.last_sync_at = sync_time
                         existing.deleted_at = None
                     else:

nginx/conf.d/pvemanager.conf

@@ -0,0 +1,82 @@
+# NGINX Configuration Template for Server Panel (HTTP only, no SSL)
+# Replace pve.cloudly.uz with your actual domain or server IP
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name pve.cloudly.uz;
+
+    # Logging
+    access_log /var/log/nginx/pvemanager_access.log;
+    error_log /var/log/nginx/pvemanager_error.log;
+
+    # Let's Encrypt challenge (needed for SSL certificate obtaining)
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+        try_files $uri =404;
+    }
+
+    # Rate limiting
+    limit_req zone=general burst=20 nodelay;
+    limit_conn addr 10;
+
+    # Health check endpoint
+    location /health {
+        proxy_pass http://pvemanager-app:8000;
+        access_log off;
+    }
+
+    # API proxy
+    location /api/ {
+        limit_req zone=api burst=50 nodelay;
+        proxy_pass http://pvemanager-app:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Proxmox API proxy
+    location /proxmox/ {
+        proxy_pass http://pvemanager-app:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 60s;
+    }
+
+    # WebSocket support — tasks и terminal
+    location ~ ^/(ws|proxmox/ws)/ {
+        proxy_pass http://pvemanager-app:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 86400;
+        proxy_send_timeout 86400;
+    }
+
+    # Backend static files (legacy, logo, etc.)
+    location /static/ {
+        proxy_pass http://pvemanager-app:8000;
+        proxy_cache_valid 200 1d;
+        expires 1d;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # SPA frontend — all other routes
+    location / {
+        proxy_pass http://pvemanager-frontend:80;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}