Add update-vendor.sh symlink support, unify install.sh vendor flow

- update-vendor.sh now creates webui/vendor symlinks (htm.js)
- install.sh calls update-vendor.sh after package install
- Add vendor/.empty and webui/vendor/.empty as directory placeholders in git

docs/architecture.md

@@ -37,7 +37,7 @@ External Client ──→ nginx (SSL termination) ──→ Flask WebUI (127.0.0
 Flask WebUI ──→ daemon/client.py (path resolution, Unix socket) ──→ vacuum-walld (aiohttp server)
 vacuum-walld ──→ daemon/handlers/firewall.py ──→ sudo firewall-cmd ──→ firewalld / D-Bus ──→ nftables
 vacuum-walld ──→ daemon/handlers/nginx.py ──→ write local .conf files ──→ sudo cp to /etc/nginx/ ──→ sudo nginx -t && sudo nginx -s reload
-vacuum-walld ──→ daemon/handlers/dnsmasq.py ──→ render config ──→ sudo tee /etc/dnsmasq.d/vacuum-wall.conf ──→ sudo systemctl reload dnsmasq
+vacuum-walld ──→ daemon/handlers/dnsmasq.py ──→ render config ──→ sudo cp /tmp/... /etc/dnsmasq.d/vacuum-wall.conf ──→ sudo systemctl restart dnsmasq
 vacuum-walld ──→ daemon/handlers/acme.py ──→ acme.sh (subprocess) ──→ deploy hook (daemon API) ──→ ACME provider
 vacuum-walld ──→ daemon/handlers/wireguard.py ──→ render data/wireguard/wg0.conf ──→ sudo cp to /etc/wireguard/ ──→ sudo wg-quick up wg0
 vacuum-walld ──→ daemon/handlers/network.py ──→ render 50-<name>.network ──→ sudo cp to /etc/systemd/network/ ──→ sudo networkctl reload

docs/overview.md

@@ -136,7 +136,7 @@ After installation, access the management interface at `https://<hostname>.local
 │   ├── config.md
 │   └── hoover.md            # Hoover SPA framework
 └── scripts/                   # Utility scripts
-    └── update-vendor.sh      # Download acme.sh binary
+    └── update-vendor.sh      # Download vendored libraries (acme.sh, htm)
 ```
 
 ## Documentation

docs/security.md

@@ -29,10 +29,9 @@ The file `/etc/sudoers.d/vacuum-walld` grants the daemon user (`vacuum-walld`) p
 | Nginx file ops | `cp -- * /etc/nginx/snippets/*` | Copy rendered config files to system paths |
 | Nginx file ops | `rm /etc/nginx/conf.d/vacuum-wall.conf`, `/etc/nginx/snippets/vacuum-wall-ssl.conf` | Clean up generated nginx config files |
 | Nginx file ops | `chown root:root /etc/nginx/conf.d/vacuum-wall.conf`, `/etc/nginx/snippets/vacuum-wall-ssl.conf` | Ensure correct ownership of nginx config files |
-| Dnsmasq | `systemctl reload dnsmasq` | Apply updated dnsmasq configuration |
+| Dnsmasq | `systemctl restart dnsmasq` | Apply updated dnsmasq configuration |
 | Dnsmasq | `systemctl is-active dnsmasq` | Check dnsmasq service status |
 | Networkd | `systemctl is-active dnsmasq` | Check dnsmasq service status |
-| Dnsmasq file ops | `tee /etc/dnsmasq.d/vacuum-wall.conf` | Write dnsmasq configuration |
 | Dnsmasq file ops | `mkdir -p /etc/dnsmasq.d` | Ensure target directory exists |
 | Dnsmasq file ops | `cp -- * /etc/dnsmasq.d/*` | Copy rendered config files |
 | Dnsmasq leases | `cat /var/lib/dnsmasq/dnsmasq.leases` | Read dnsmasq lease table |