refactor: introduce two-user daemon architecture with socket-based communication

- Add daemon/ module with aiohttp server, sync client, and handler registry
- Add daemon/handlers/ for privileged operations (acme, dnsmasq, firewall, logs, nginx, wireguard)
- Add system/acme-deploy.py, vacuum-walld sudoers and systemd service
- Update API routes to use daemon client instead of lib/ directly
- Update lib/, tests/, and webui/ for new architecture
- Update docs and deployment scripts

tests/test_server.py

@@ -90,27 +90,8 @@ class TestSafelyHelper:
 
 
 class TestPageRoutes:
-    @patch("webui.server.get_active_zones")
-    @patch("webui.server.get_interfaces")
-    @patch("webui.server.dnsmasq_status")
-    @patch("webui.server.get_domains")
-    @patch("webui.server.list_certs")
-    @patch("webui.server.wg_status")
-    def test_dashboard_no_crash(
-        self,
-        mock_wg,
-        mock_certs,
-        mock_domains,
-        mock_dnsmasq,
-        mock_ifaces,
-        mock_zones,
-        client,
-    ):
-        mock_zones.return_value = {}
-        mock_ifaces.return_value = []
-        mock_dnsmasq.return_value = {}
-        mock_domains.return_value = []
-        mock_certs.return_value = []
-        mock_wg.return_value = {}
+    @patch("webui.server.get")
+    def test_dashboard_no_crash(self, mock_get, client):
+        mock_get.return_value = {}
         resp = client.get("/")
         assert resp.status_code == 200