refactor: introduce two-user daemon architecture with socket-based communication

- Add daemon/ module with aiohttp server, sync client, and handler registry
- Add daemon/handlers/ for privileged operations (acme, dnsmasq, firewall, logs, nginx, wireguard)
- Add system/acme-deploy.py, vacuum-walld sudoers and systemd service
- Update API routes to use daemon client instead of lib/ directly
- Update lib/, tests/, and webui/ for new architecture
- Update docs and deployment scripts

docs/overview.md

@@ -6,7 +6,7 @@ Vacuum Wall is a zone-based firewall appliance with a built-in SSL reverse proxy
 
 ## Architecture Overview
 
-Vacuum Wall is built around four integrated subsystems managed through a central Flask web interface. The traffic plane uses firewalld with its nftables backend, supporting zone-based policies, source NAT, and destination NAT for port forwarding. The DNS/DHCP plane serves private subnets via dnsmasq, providing address allocation and local name resolution. The proxy plane runs nginx with automatic ACME certificates through acme.sh, handling SSL termination and reverse proxying for backend services. The VPN plane uses WireGuard (wg-quick) for encrypted tunnel management. All subsystems are configured and monitored through the Flask web UI, which is itself proxied through nginx with basic HTTP authentication.
+Vacuum Wall is built around four integrated subsystems managed through a two-layer architecture: a non-privileged Flask web UI and a privileged background daemon (`vacuum-walld`). The web UI communicates with the daemon via a Unix socket. The daemon handles all privileged operations (sudo) for the subsystems: the traffic plane uses firewalld with its nftables backend (zone-based policies, source NAT, destination NAT); the DNS/DHCP plane serves private subnets via dnsmasq; the proxy plane runs nginx with automatic ACME certificates through acme.sh; and the VPN plane uses WireGuard (wg-quick) for encrypted tunnel management. All subsystems are configured and monitored through the Flask web UI, which is itself proxied through nginx with basic HTTP authentication.
 
 ## Subsystems
 
@@ -60,13 +60,20 @@ After installation, access the management interface at `https://<hostname>.local
 ├── .venv/                   # Python virtual environment
 ├── config/                  # Declarative JSON configuration (source of truth)
 │   ├── dnsmasq/             # DHCP/DNS config
+│   ├── firewall/            # Firewall zone & rule config
 │   ├── nginx/               # Proxy domain & SSL config
 │   └── wireguard/           # VPN interface & peer config
 ├── data/                    # Runtime artifacts & generated files
 │   ├── nginx/sites-enabled/ # Generated server blocks
 │   ├── dnsmasq/fragments/   # User config fragments
 │   ├── acme/                # ACME certificates
-│   └── firewall/            # Firewall rule backup
+│   ├── firewall/            # Firewall rule backup
+│   ├── logs/                # Application logs
+│   └── wireguard/           # Generated WireGuard configs
+├── daemon/                  # Privileged background daemon
+│   ├── server.py            # aiohttp server, cache, batch routing, handler registry
+│   ├── client.py            # Sync HTTP client over Unix socket
+│   └── handlers/            # Privileged operation handlers (all sudo calls)
 ├── system/                  # System file templates (all Jinja2)
 │   ├── systemd/             # Service and timer unit files
 │   │   ├── vacuum-wall.service        # Web UI service (rendered at install)
@@ -86,17 +93,25 @@ After installation, access the management interface at `https://<hostname>.local
 │   └── wireguard.py         # VPN tunnel management
 ├── webui/                   # Flask web application
 │   ├── server.py            # Application entry point
-│   ├── api/                 # REST API route modules
-│   │   └── common.py        # Shared API response helpers (_ok, _error)
+│   ├── api/                 # REST API route modules (blueprints)
+│   │   ├── common.py        # Shared API response helpers (_ok, _error)
+│   │   ├── firewall.py      # Firewall API
+│   │   ├── dhcp.py          # DHCP/DNS API
+│   │   ├── proxy.py         # Nginx proxy API
+│   │   ├── certs.py         # Certificate API
+│   │   ├── wireguard.py     # WireGuard API
+│   │   └── logs.py          # Logs API
 │   ├── templates/           # Jinja2/HTMX templates
 │   └── static/              # CSS and client-side JS
-└── docs/                    # Documentation
-    ├── overview.md          # This file
-    ├── deployment.md
-    ├── api.md
-    ├── security.md
-    ├── architecture.md
-    └── config.md
+├── docs/                    # Documentation
+│   ├── overview.md          # This file
+│   ├── deployment.md
+│   ├── api.md
+│   ├── security.md
+│   ├── architecture.md
+│   └── config.md
+└── scripts/                   # Utility scripts
+    └── update-vendor.sh      # Vendor frontend library updates
 ```
 
 ## Documentation