refactor: introduce two-user daemon architecture with socket-based communication

- Add daemon/ module with aiohttp server, sync client, and handler registry
- Add daemon/handlers/ for privileged operations (acme, dnsmasq, firewall, logs, nginx, wireguard)
- Add system/acme-deploy.py, vacuum-walld sudoers and systemd service
- Update API routes to use daemon client instead of lib/ directly
- Update lib/, tests/, and webui/ for new architecture
- Update docs and deployment scripts

pyproject.toml

@@ -9,8 +9,13 @@ description = "SSL proxy / firewall appliance with zone-based policies"
 requires-python = ">=3.13"
 dependencies = [
     "Flask>=3.0,<4.0",
+    "aiohttp>=3.9,<4.0",
+    "requests-unixsocket>=0.2,<1.0",
 ]
 
+[project.scripts]
+vacuum-walld = "daemon.server:main"
+
 [project.optional-dependencies]
 dev = [
     "ruff>=0.4.0",
@@ -19,7 +24,7 @@ dev = [
 ]
 
 [tool.setuptools.packages.find]
-include = ["lib*", "webui*"]
+include = ["lib*", "webui*", "daemon*"]
 
 [tool.ruff]
 target-version = "py313"