Fix Pangolin sync siteId resolution, nginx media proxy, and upgrade script

- Resolve Pangolin site slug to numeric ID in sync route (fixes target creation 400 errors)
- Disable SSO on newly created Pangolin resources for public access
- Fix nginx media API proxy: use rewrite + set ordering for proper URI rewriting
- Upgrade script: clear skip-worktree flags, fix Docker-owned dir permissions, stash untracked files

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/upgrade.sh

@@ -584,13 +584,29 @@ fi
 # Step 0: Save user-modifiable paths before any git operations
 save_user_paths
 
+# Step 0b: Clear skip-worktree flags that prevent merge (e.g., repo-data JSON files)
+SKIP_WORKTREE_FILES="$(git ls-files -v | grep '^S ' | awk '{print $2}' || true)"
+if [[ -n "$SKIP_WORKTREE_FILES" ]]; then
+  info "Clearing skip-worktree flags on $(echo "$SKIP_WORKTREE_FILES" | wc -l | xargs) file(s)..."
+  echo "$SKIP_WORKTREE_FILES" | xargs git update-index --no-skip-worktree
+  success "Skip-worktree flags cleared"
+fi
+
+# Step 0c: Fix Docker-owned directories that block git checkout
+for owned_dir in api/upgrade api/uploads api/configs; do
+  if [[ -d "$PROJECT_DIR/$owned_dir" ]] && [[ ! -w "$PROJECT_DIR/$owned_dir" ]]; then
+    info "Fixing permissions on $owned_dir..."
+    docker run --rm -v "$PROJECT_DIR/$owned_dir:/fix" alpine chown -R "$(id -u):$(id -g)" /fix 2>/dev/null || true
+  fi
+done
+
 # Step 1: Stash user changes if any exist
 HAS_CHANGES=false
 if [[ -n "$(git status --porcelain 2>/dev/null)" ]]; then
   HAS_CHANGES=true
   STASH_NAME="upgrade-${TIMESTAMP}"
   info "Stashing local changes as '$STASH_NAME'..."
-  git stash push -m "$STASH_NAME"
+  git stash push --include-untracked -m "$STASH_NAME"
   success "Local changes stashed"
 fi