refactor: introduce two-user daemon architecture with socket-based communication

- Add daemon/ module with aiohttp server, sync client, and handler registry
- Add daemon/handlers/ for privileged operations (acme, dnsmasq, firewall, logs, nginx, wireguard)
- Add system/acme-deploy.py, vacuum-walld sudoers and systemd service
- Update API routes to use daemon client instead of lib/ directly
- Update lib/, tests/, and webui/ for new architecture
- Update docs and deployment scripts

system/systemd/vacuum-walld.service

@@ -0,0 +1,42 @@
+[Unit]
+Description=Vacuum Wall Daemon (privileged backend)
+Documentation=https://github.com/wall/vacuum-wall
+After=network.target firewalld.service
+Wants=firewalld.service
+
+[Service]
+Type=simple
+User={{ USER_DAEMON_NAME }}
+Group={{ USER_GROUP }}
+WorkingDirectory={{ PROJECT_DIR }}
+ExecStart={{ PROJECT_DIR }}/.venv/bin/python -m daemon
+Restart=on-failure
+RestartSec=5
+Environment=PATH=/usr/local/bin:/usr/bin
+Environment=PYTHONUNBUFFERED=1
+Environment=ACME_HOME={{ PROJECT_DIR }}/data/acme
+Environment=HOME={{ PROJECT_DIR }}
+
+# Security hardening
+ProtectSystem=strict
+ReadWritePaths={{ PROJECT_DIR }} /tmp
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+ProtectHostname=yes
+RestrictSUIDSGID=yes
+MemoryDenyWriteExecute=yes
+RestrictRealtime=yes
+RestrictNamespaces=yes
+LockPersonality=yes
+SystemCallFilter=@system-service
+PrivateDevices=yes
+
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+IPAddressDeny=any
+IPAddressAllow=localhost
+NoNewPrivileges=yes
+
+[Install]
+WantedBy=multi-user.target