refactor: introduce two-user daemon architecture with socket-based communication

- Add daemon/ module with aiohttp server, sync client, and handler registry
- Add daemon/handlers/ for privileged operations (acme, dnsmasq, firewall, logs, nginx, wireguard)
- Add system/acme-deploy.py, vacuum-walld sudoers and systemd service
- Update API routes to use daemon client instead of lib/ directly
- Update lib/, tests/, and webui/ for new architecture
- Update docs and deployment scripts

docs/api.md

@@ -174,6 +174,8 @@ Create a new firewalld zone.
 
 **Response:** `data` is `null` on success.
 
+Returns HTTP `400` if the zone already exists.
+
 ---
 
 #### Delete Zone
@@ -637,6 +639,74 @@ Returns HTTP `404` if no matching record is found.
 
 Endpoints prefixed with `/api/proxy/...`. Manage reverse proxy domains, nginx configuration generation, and the management WebUI proxy.
 
+### Configuration
+
+#### Get Proxy Configuration
+
+```
+GET /api/proxy/config
+```
+
+Return the current proxy configuration object.
+
+**Response:**
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `data` | `object` | Full proxy configuration dictionary |
+
+---
+
+#### Replace Proxy Configuration
+
+```
+POST /api/proxy/config
+```
+
+Replace the entire proxy configuration with the provided JSON object.
+
+**Request Body:**
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| *(entire body)* | `object` | Yes | Complete proxy configuration object |
+
+**Response:** `data` is `null` on success.
+
+---
+
+#### Partial Update Proxy Configuration
+
+```
+PATCH /api/proxy/config
+```
+
+Deep-merge the provided fields into the existing proxy configuration.
+
+**Request Body:**
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| *(any subset)* | `any` | Yes | Fields to merge into the config |
+
+**Response:** `data` is `null` on success.
+
+---
+
+### SSL
+
+#### Apply SSL Snippet
+
+```
+POST /api/proxy/ssl-apply
+```
+
+Write the global nginx SSL snippet configuration.
+
+**Response:** `data` is `null` on success.
+
+---
+
 ### Domain Management
 
 #### List All Domains
@@ -842,6 +912,7 @@ Request a new certificate for a domain.
 | Field | Type | Required | Description |
 |-------|------|----------|-------------|
 | `domain` | `string` | Yes | Domain to issue the certificate for |
+| `email` | `string` | No | ACME contact email |
 | `webroot` | `string` | No | Custom webroot path for HTTP-01 validation |
 
 **Response:** `data` is `null` on success.
@@ -932,7 +1003,7 @@ Replace the entire WireGuard configuration. The `private_key` field is stripped
 |-------|------|----------|-------------|
 | *(entire body)* | `object` | Yes | Complete WireGuard configuration object |
 
-**Response:** `data` contains the updated configuration (`private_key` omitted).
+**Response:** `data` is `null` on success.
 
 ---
 
@@ -1115,4 +1186,70 @@ Generate a complete WireGuard client configuration file. The returned config inc
 
 This is the only endpoint that returns a WireGuard private key. All other endpoints strip private keys from responses.
 
-Returns HTTP `404` if the peer is not found.
+Returns HTTP `404` if the peer is not found.
+
+---
+
+## Logs API
+
+Endpoints prefixed with `/api/logs/...`. Serve rendered HTML log line fragments for HTMX consumption. These endpoints **do not** follow the standard JSON `{"ok": true, "data": ...}` response contract — they return HTML `<div>` elements directly. Errors are rendered inline as `(error reading ...)` text rather than returning JSON error responses.
+
+### System Journal
+
+#### Get Journal Entries
+
+```
+GET /api/logs/journal
+```
+
+Return recent system journal entries as rendered HTML log lines.
+
+**Response:** HTML fragment of `<div class="log-line">` elements.
+
+### Nginx Logs
+
+#### Nginx Access Log
+
+```
+GET /api/logs/nginx/access
+```
+
+Return recent nginx access log entries as rendered HTML.
+
+**Response:** HTML fragment of `<div class="log-line">` elements.
+
+---
+
+#### Nginx Error Log
+
+```
+GET /api/logs/nginx/error
+```
+
+Return recent nginx error log entries as rendered HTML.
+
+**Response:** HTML fragment of `<div class="log-line">` elements.
+
+### Dnsmasq Log
+
+#### Dnsmasq Entries
+
+```
+GET /api/logs/dnsmasq
+```
+
+Return recent dnsmasq journal entries as rendered HTML.
+
+**Response:** HTML fragment of `<div class="log-line">` elements.
+
+### Application Log
+
+#### App Log Entries
+
+```
+GET /api/logs/app
+```
+
+Return recent application log entries as rendered HTML.
+
+**Response:** HTML fragment of `<div class="log-line">` elements.