Fix nginx proxy start/stop: missing sudo, silent failures, no progress UI

- ProxyManager::sysctl() and reload() now use sudo for local commands —
  www-data cannot run systemctl directly, so start/stop/restart/reload
  were silently failing with permission denied
- Control endpoint now returns success:false when nginx stays stopped
  after a start/restart, or stays running after a stop
- proxyControl() JS shows a loading overlay while the action runs and
  uses error toast when the action reports failure

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

panel/lib/ProxyManager.php

@@ -145,9 +145,9 @@ class ProxyManager {
             self::remoteExec('systemctl reload nginx');
             return 'reloaded';
         }
-        $test = shell_exec('nginx -t 2>&1');
+        $test = shell_exec('sudo nginx -t 2>&1');
         if (strpos($test ?? '', 'successful') === false) return 'Config test failed: ' . $test;
-        shell_exec('systemctl reload nginx 2>/dev/null');
+        shell_exec('sudo systemctl reload nginx 2>/dev/null');
         return 'reloaded';
     }
 
@@ -565,7 +565,7 @@ BASH;
             sleep(1);
             return self::isRunning() ? 'running' : 'stopped';
         }
-        shell_exec("systemctl {$action} nginx 2>/dev/null");
+        shell_exec("sudo systemctl {$action} nginx 2>/dev/null");
         sleep(1);
         return self::isRunning() ? 'running' : 'stopped';
     }