Add update-vendor.sh symlink support, unify install.sh vendor flow

- update-vendor.sh now creates webui/vendor symlinks (htm.js)
- install.sh calls update-vendor.sh after package install
- Add vendor/.empty and webui/vendor/.empty as directory placeholders in git

daemon/handlers/wireguard.py

@@ -24,7 +24,15 @@ from daemon.iface import (
     POST_WIREGUARD_PEERS_ADD,
 )
 from daemon.server import NotFoundError, refresh_state, registry
-from lib.common import deep_merge, load_json, run, run_proc, save_json
+from lib.common import (
+    _APPLY_HASH_KEY,
+    config_hash,
+    deep_merge,
+    load_json,
+    run,
+    run_proc,
+    save_json,
+)
 from lib.sync import SyncEvent, bus
 
 logger = logging.getLogger(__name__)
@@ -102,7 +110,7 @@ def get_config(_request: Any, _body: Any) -> dict[str, Any]:
     if wg:
         return wg.get("config", {})
     cfg = _get_config()
-    safe = dict(cfg)
+    safe = {k: v for k, v in cfg.items() if k != _APPLY_HASH_KEY}
     if "interface" in safe:
         safe["interface"] = dict(safe["interface"])
         safe["interface"].pop("private_key", None)
@@ -174,6 +182,9 @@ def apply(_request: Any, _body: Any) -> dict[str, Any]:
     local_tmp.unlink(missing_ok=True)
     run([WG_QUICK_BIN, "up", cfg["interface"]["name"]], sudo=True)
     logger.info("WireGuard tunnel '%s' brought up", cfg["interface"]["name"])
+    cfg_after = _get_config()
+    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+    _save_config(cfg_after)
     sync_result = bus.emit(
         SyncEvent("wireguard", "config_saved", {"action": "config_applied"})
     )