fix(ui): correct HTTPS URL override toggle + normalize derived override (#355)

Two follow-ups to the derive/show/override settings work:

- The "advanced override" affordance reused the .info-toggle style with a
  text label, which is an 18px circular icon badge — the label rendered as
  a broken blue circle. Use the icon-toggle pattern like TLS extra hosts:
  a small ⓘ that reveals a details block containing the explanation and the
  override input.

- Existing installs persist their old effective HTTPS URL in the (now
  override) https_server_url field, so the UI showed "(override)" even when
  the value equals what we would derive. On load, treat an override that
  exactly matches the derived URL as "derive" (clear it), so default
  installs show "(derived from Target Domain)"; genuinely custom values are
  kept as overrides.

Verified live: an existing settings.json with https_server_url equal to the
derived value now reports an empty override, and the served admin HTML uses
the ⓘ toggle.

refs #355

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

cmd/soundtouch-service/main.go

@@ -964,10 +964,17 @@ func applyPersistedSettings(ds *datastore.DataStore, config *serviceConfig) data
 	}
 
 	// persisted.HTTPServerURL is the HTTPS override (empty = derive).
-	// Existing installs carry their old effective value here, so it is
-	// preserved as an override; recompute the effective URL either way,
-	// since serverURL may have come from the persisted settings above.
+	// Existing installs carry their old effective value here; if it is
+	// exactly what we would derive anyway, treat it as "derive" so those
+	// installs don't show a spurious override in the UI. A genuinely custom
+	// value is kept as an override. Recompute either way, since serverURL
+	// may have come from the persisted settings above.
 	config.httpsOverride = persisted.HTTPServerURL
+	if config.httpsOverride != "" &&
+		config.httpsOverride == handlers.DeriveHTTPSURL(config.serverURL, "", config.httpsPort, config.httpsDefaultURL) {
+		config.httpsOverride = ""
+	}
+
 	config.httpsServerURL = handlers.DeriveHTTPSURL(config.serverURL, config.httpsOverride, config.httpsPort, config.httpsDefaultURL)
 
 	config.discoveryEnabled = persisted.DiscoveryEnabled

pkg/service/handlers/web/index.html

@@ -187,21 +187,20 @@
             <label>HTTPS URL:</label>
             <code id="https-url-effective">—</code>
             <span id="https-url-effective-note" style="font-size: 0.8em; color: #666"></span>
-            <div style="margin-top: 6px">
-                <span class="info-toggle" onclick="toggleInfo('https-url-override-info')">Advanced: override HTTPS URL ⓘ</span>
-                <div id="https-url-override-info" class="info-details">
-                    <p style="font-size: 0.85em; color: #666; margin: 4px 0">
-                        AfterTouch also serves an HTTPS endpoint (used for the
-                        DNS-based redirect, music-service login, and certificate
-                        trust). By default it follows the Target Domain above
-                        (same host, on the HTTPS port), so you normally don't
-                        set anything here. Provide an override only when a
-                        reverse proxy serves HTTPS on a different host or port.
-                        Leave it empty to go back to deriving it automatically.
-                        Takes effect after saving.
-                    </p>
-                    <input type="text" id="https-url-override" placeholder="https://host:8443 (empty = derive)" style="width: 300px"/>
-                </div>
+            <span class="info-toggle" onclick="toggleInfo('https-url-override-info')">ⓘ</span>
+            <div id="https-url-override-info" class="info-details">
+                <p style="margin: 0 0 8px 0">
+                    AfterTouch also serves an HTTPS endpoint (used for the
+                    DNS-based redirect, music-service login, and certificate
+                    trust). By default it follows the Target Domain above
+                    (same host, on the HTTPS port), so you normally don't set
+                    anything here. Provide an override only when a reverse
+                    proxy serves HTTPS on a different host or port. Leave it
+                    empty to go back to deriving it automatically. Takes effect
+                    after saving.
+                </p>
+                <label for="https-url-override">Override:</label>
+                <input type="text" id="https-url-override" placeholder="https://host:8443 (empty = derive)" style="width: 300px"/>
             </div>
         </div>
         <div style="margin-bottom: 20px">