refactor: introduce two-user daemon architecture with socket-based communication

- Add daemon/ module with aiohttp server, sync client, and handler registry
- Add daemon/handlers/ for privileged operations (acme, dnsmasq, firewall, logs, nginx, wireguard)
- Add system/acme-deploy.py, vacuum-walld sudoers and systemd service
- Update API routes to use daemon client instead of lib/ directly
- Update lib/, tests/, and webui/ for new architecture
- Update docs and deployment scripts

system/acme-deploy.py

@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+"""acme-deploy.py — Deploy hook for acme.sh (Vacuum Wall).
+
+Called by acme.sh after every successful certificate issue or renewal.
+Reloads nginx via the daemon API so acme.sh never touches sudo directly.
+"""
+
+import logging
+import os
+import sys
+
+try:
+    import requests_unixsocket
+
+    from daemon.client import post
+
+    logging.basicConfig(level=logging.INFO)
+    project_dir = os.environ.get("INSTALL_DIR", os.path.dirname(os.path.dirname(__file__)))
+    socket_path = os.environ.get(
+        "VACUUM_WALLD_SOCKET",
+        os.path.join(project_dir, "data", "daemon.sock"),
+    )
+    post("/nginx/reload", socket_path=socket_path)
+    sys.exit(0)
+except Exception as exc:
+    logging.error("acme-deploy hook failed: %s", exc)
+    sys.exit(0)