fix: ACME ownership self-heal + daily timer, apply-all force, firewall baseline re-stamp

acme:
- acme.sh chmods its tree to owner-only (700/600) every run, which
  broke the two-user model: a tree left owner-only by one user made
  every acme.sh call of the other exit 2
- normalize_acme_home() reopens group access (sudo chmod g+rwX,
  files only — setgid dirs trip RestrictSUIDSGID); _run_acme_preflight
  is the choke point before every daemon acme.sh call + startup
- acme service now runs as the daemon user; --log persists the raw CA
  transcript; SYS_LOG=6 journals manual issue/renew runs
- timer daily-only: two runs/day landed inside ZeroSSL's 24h
  validation backoff (Retry-After: 86400) — a permanent renewal lockout
- _collect_acme no longer raises on cert-list failure; reports
  status.error (AcmeState.status) so the certs page can surface it

firewall: re-stamp the applied baseline on live zone mutations
(interfaces/services/rich-rules/masquerade/forward-ports) so cancel-all
reverts to post-mutation state, not a stale install-era snapshot;
set_masquerade syncs the declarative config for existing zones;
add_forward_port records toaddr only with toport

status: apply-all accepts {"force": true} (forwarded to the firewall
apply only); ApplyConfirm force checkbox; applyResultToasts() — the
errors map wins over the 200; ActionButton checks errors before the
success toast; dashboard uses ApplyConfirm

system_import: drift re-imports carry the existing apply-meta; first
import stamps the adopted content as applied (it is the running state)
— no phantom pending changes

nginx: get_config only re-saves when migration actually changed the
config (no more owner/mtime churn on every read)

install: repair mis-owned top-level system dirs (tmpfiles
unsafe-path-transition), warn with a full-repair command for deeper
mis-ownership

daemon/server: loop.get_exception_handler() (aiohttp API fix)

tests: 888 pytest + 24 node passing; ruff clean

webui/static/hoover/components/data.js

@@ -171,13 +171,22 @@ export function ActionButton(props = {}) {
                 if (body !== undefined) opts.body = body;
                 const resp = await apiFetch(props.url, opts);
                 if (resp.ok) {
-                    const synced = resp.data?.synced;
-                    let msg = props.successMsg || '';
-                    if (synced && synced.length) {
-                        if (msg) msg += ' ';
-                        msg += '(auto-synced: ' + synced.join(', ') + ')';
+                    // Batch endpoints (e.g. /api/status/apply-all) return 200
+                    // with an `errors` map when some operations failed —
+                    // `resp.ok` alone is not a success signal.
+                    const errs = (resp.data && typeof resp.data.errors === 'object') ? resp.data.errors : null;
+                    const errEntries = errs ? Object.entries(errs) : [];
+                    if (errEntries.length) {
+                        toast('Failed: ' + errEntries.map(([k, v]) => `${k} — ${v}`).join('; '), 'error', 8000);
+                    } else {
+                        const synced = resp.data?.synced;
+                        let msg = props.successMsg || '';
+                        if (synced && synced.length) {
+                            if (msg) msg += ' ';
+                            msg += '(auto-synced: ' + synced.join(', ') + ')';
+                        }
+                        if (msg) toast(msg, 'success');
                     }
-                    if (msg) toast(msg, 'success');
                     if (props.onSuccess) props.onSuccess();
                     // No modelFetch — WS delta updates state store models.
                 } else {