fix htmx refactor route mismatches and remaining TODO items

- wireguard: POST /peers with JSON encoding (was /add-peer)
- rules: delete by rule_id in URL path (was JSON body); pass rule objects with id from server; add hx-disable to initial render
- nat: port forward delete uses URL path params to match blueprint
- nat: masquerade toggle uses native hx-post/hx-vals (was inline fetch)
- app.js renderers updated to use URL path deletes for rules and forwards
- remove TODO.md

webui/api/certs.py

@@ -4,6 +4,8 @@ webui/api/certs.py - ACME certificate management API blueprint.
 Exposed at /api/certs/* and delegates to lib.acme.
 """
 
+import logging
+
 from flask import Blueprint, jsonify, request
 
 from lib.acme import (
@@ -15,6 +17,7 @@ from lib.acme import (
     set_email,
 )
 
+logger = logging.getLogger(__name__)
 bp = Blueprint("certs", __name__)
 
 
@@ -41,6 +44,7 @@ def list_certs_bp():
     try:
         return _ok(list_certs())
     except RuntimeError as exc:
+        logger.error("Failed to list certificates: %s", exc)
         return _error(str(exc), 500)
 
 
@@ -52,6 +56,7 @@ def cert_details(domain):
     except ValueError as exc:
         return _error(str(exc), 404)
     except RuntimeError as exc:
+        logger.error("Failed to get cert info for '%s': %s", domain, exc)
         return _error(str(exc), 500)
 
 
@@ -68,11 +73,17 @@ def issue_bp():
         return _error("'domain' is required", 400)
     webroot = body.get("webroot")
     try:
+        logger.info("Certificate issuance requested for '%s' via API", domain)
         result = issue(domain, webroot=webroot)
         if result.get("success"):
+            logger.info("Certificate issued for '%s'", domain)
             return _ok(None)
+        logger.error(
+            "Certificate issuance failed for '%s': %s", domain, result.get("error")
+        )
         return _error(result.get("error", "Unknown error"), 500)
     except RuntimeError as exc:
+        logger.error("Exception issuing cert for '%s': %s", domain, exc)
         return _error(str(exc), 500)
 
 
@@ -84,11 +95,17 @@ def issue_bp():
 @bp.route("/<domain>/renew", methods=["POST"])
 def renew_bp(domain):
     try:
+        logger.info("Certificate renewal requested for '%s' via API", domain)
         result = renew(domain)
         if result.get("success"):
+            logger.info("Certificate renewed for '%s'", domain)
             return _ok(None)
+        logger.error(
+            "Certificate renewal failed for '%s': %s", domain, result.get("error")
+        )
         return _error(result.get("error", "Unknown error"), 500)
     except RuntimeError as exc:
+        logger.error("Exception renewing cert for '%s': %s", domain, exc)
         return _error(str(exc), 500)
 
 
@@ -104,11 +121,14 @@ def remove_bp(domain):
     except ValueError as exc:
         return _error(str(exc), 404)
     except RuntimeError as exc:
+        logger.error("Failed to verify cert '%s': %s", domain, exc)
         return _error(str(exc), 500)
     try:
         remove(domain)
+        logger.info("Certificate removed for '%s' via API", domain)
         return _ok(None)
     except RuntimeError as exc:
+        logger.error("Failed to remove cert '%s': %s", domain, exc)
         return _error(str(exc), 500)
 
 
@@ -125,6 +145,8 @@ def set_email_bp():
         return _error("'email' is required", 400)
     try:
         set_email(email)
+        logger.info("ACME email set via API: %s", email)
         return _ok({"email": email})
     except RuntimeError as exc:
+        logger.error("Failed to set ACME email: %s", exc)
         return _error(str(exc), 500)