Update .gitignore, AGENTS.md, README.md for config/ split and deployment model

README.md

@@ -7,7 +7,7 @@ A zone-based firewall appliance with a built-in SSL reverse proxy. Combines fire
 - Debian 13 (trixie) target platform
 - Python 3.13+, Flask 3.x web UI
 - firewalld (nftables backend), dnsmasq, nginx, WireGuard
-- acme.sh for Let's Encrypt
+- acme.sh for ACME certificates (ZeroSSL)
 - HTMX + Jinja2 templates
 
 ---
@@ -37,7 +37,7 @@ bash install.sh
 | `MGMT_DOMAIN` | Yes | Public domain for the management WebUI |
 | `MGMT_PASS` | Yes | HTTP basic auth password for the WebUI |
 | `MGMT_USER` | No | WebUI username (defaults to `admin`) |
-| `ACME_EMAIL` | Yes | Let's Encrypt registration email |
+| `ACME_EMAIL` | Yes | ACME registration email (ZeroSSL by default) |
 
 After installation, access the WebUI at `https://<MGMT_DOMAIN>`. The initial certificate is self-signed — use the Certs tab to issue a real one once DNS is propagating.
 
@@ -45,7 +45,7 @@ After installation, access the WebUI at `https://<MGMT_DOMAIN>`. The initial cer
 
 1. **Assign interfaces** to zones from the Interfaces tab
 2. **Configure DHCP** ranges for your LAN
-3. **Add proxy domains** with Let's Encrypt certificates
+3. **Add proxy domains** with ACME certificates
 4. **Set up WireGuard** (optional)
 
 See [docs/deployment.md](docs/deployment.md) for the full guide, including troubleshooting.