refactor: introduce two-user daemon architecture with socket-based communication

- Add daemon/ module with aiohttp server, sync client, and handler registry
- Add daemon/handlers/ for privileged operations (acme, dnsmasq, firewall, logs, nginx, wireguard)
- Add system/acme-deploy.py, vacuum-walld sudoers and systemd service
- Update API routes to use daemon client instead of lib/ directly
- Update lib/, tests/, and webui/ for new architecture
- Update docs and deployment scripts

system/systemd/vacuum-wall.service

@@ -1,13 +1,14 @@
 [Unit]
 Description=Vacuum Wall Management WebUI
 Documentation=https://github.com/wall/vacuum-wall
-After=network.target firewalld.service nginx.service dnsmasq.service
+Requires=vacuum-walld.service
+After=network.target firewalld.service nginx.service dnsmasq.service vacuum-walld.service
 Wants=firewalld.service
 
 [Service]
 Type=simple
 User={{ USER_NAME }}
-Group={{ USER_NAME }}
+Group={{ USER_GROUP }}
 WorkingDirectory={{ PROJECT_DIR }}
 ExecStart={{ PROJECT_DIR }}/.venv/bin/python webui/server.py
 Restart=on-failure