Fix Pangolin sync siteId resolution, nginx media proxy, and upgrade script

- Resolve Pangolin site slug to numeric ID in sync route (fixes target creation 400 errors)
- Disable SSO on newly created Pangolin resources for public access
- Fix nginx media API proxy: use rewrite + set ordering for proper URI rewriting
- Upgrade script: clear skip-worktree flags, fix Docker-owned dir permissions, stash untracked files

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

nginx/conf.d/api.conf.template

@@ -6,7 +6,8 @@ server {
     # Media API endpoints (must come BEFORE / for longest prefix match)
     # Uses variable proxy_pass for runtime DNS resolution after container restarts
     location /media/ {
-        set $upstream_media http://changemaker-media-api:4100/api/;
+        set $upstream_media http://changemaker-media-api:4100;
+        rewrite ^/media/(.*) /api/$1 break;
         proxy_pass $upstream_media;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;