Fix nginx proxy start/stop: missing sudo, silent failures, no progress UI

- ProxyManager::sysctl() and reload() now use sudo for local commands —
  www-data cannot run systemctl directly, so start/stop/restart/reload
  were silently failing with permission denied
- Control endpoint now returns success:false when nginx stays stopped
  after a start/restart, or stays running after a stop
- proxyControl() JS shows a loading overlay while the action runs and
  uses error toast when the action reports failure

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

panel/api/endpoints/proxy.php

@@ -40,13 +40,19 @@ try {
         $action === 'control' && $method === 'POST' => (function() use ($body) {
             $act = $body['action'] ?? '';
             if (!in_array($act, ['start','stop','restart','reload'])) Response::error('Invalid action', 400);
-            $result = match($act) {
+            $result  = match($act) {
                 'start'   => ProxyManager::start(),
                 'stop'    => ProxyManager::stop(),
                 'restart' => ProxyManager::restart(),
                 'reload'  => ProxyManager::reload(),
             };
-            Response::json(['success' => true, 'data' => ['result' => $result, 'running' => ProxyManager::isRunning()]]);
+            $running = ProxyManager::isRunning();
+            $success = match($act) {
+                'start', 'restart' => $running,
+                'stop'             => !$running,
+                'reload'           => !str_starts_with($result, 'Config test failed'),
+            };
+            Response::json(['success' => $success, 'data' => ['result' => $result, 'running' => $running]]);
         })(),
 
         // GET hosts list