Fix Pangolin sync siteId resolution, nginx media proxy, and upgrade script

- Resolve Pangolin site slug to numeric ID in sync route (fixes target creation 400 errors)
- Disable SSO on newly created Pangolin resources for public access
- Fix nginx media API proxy: use rewrite + set ordering for proper URI rewriting
- Upgrade script: clear skip-worktree flags, fix Docker-owned dir permissions, stash untracked files

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/src/modules/pangolin/pangolin.routes.ts

@@ -708,12 +708,25 @@ router.post('/sync', pangolinSetupLimiter, async (_req: Request, res: Response)
       return;
     }
 
-    const siteId = env.PANGOLIN_SITE_ID;
-    if (!siteId) {
+    const siteSlug = env.PANGOLIN_SITE_ID;
+    if (!siteSlug) {
       res.status(400).json({ error: { message: 'PANGOLIN_SITE_ID not set. Run setup first.', code: 'NO_SITE' } });
       return;
     }
 
+    // Resolve numeric siteId from slug (Pangolin targets require numeric siteId)
+    let siteId: string | number = siteSlug;
+    if (isNaN(Number(siteSlug))) {
+      const sites = await pangolinClient.listSites();
+      const match = sites.find(s => s.niceId === siteSlug || s.name === siteSlug);
+      if (match) {
+        siteId = match.siteId;
+        logger.info(`Resolved site slug "${siteSlug}" to numeric siteId ${siteId}`);
+      } else {
+        logger.warn(`Could not resolve site slug "${siteSlug}" to numeric ID, using as-is`);
+      }
+    }
+
     const domain = env.DOMAIN;
     const resourceDefs = loadResourceDefinitions();
     if (resourceDefs.length === 0) {
@@ -809,9 +822,9 @@ router.post('/sync', pangolinSetupLimiter, async (_req: Request, res: Response)
             protocol: 'tcp',
           });
 
-          // Make publicly accessible
+          // Make publicly accessible (disable SSO auth + blockAccess)
           try {
-            await pangolinClient.updateResource(resource.resourceId, { blockAccess: false });
+            await pangolinClient.updateResource(resource.resourceId, { sso: false, blockAccess: false });
           } catch {
             logger.warn(`Created ${fullDomain} but failed to set public access`);
           }