sync: add cross-subsystem event bus for config consistency

Add EventBus with loop guards to keep firewall, dnsmasq, wireguard,
and network configs consistent. Handlers emit SyncEvent after mutations;
subscribers compute diffs and write JSON without manual cascade loops.

docs/api.md

@@ -86,7 +86,13 @@ POST /api/firewall/config/apply
 
 Apply the declarative config to live firewalld. Applies targets, services, interfaces, masquerade, rich rules, and forward ports.
 
-**Response:** `data` contains `applied_zones` list and backup path.
+**Response (`data`):**
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `applied_zones` | `[string, ...]` | List of zone names that were applied |
+| `backup` | `string` | Path to the firewall state backup file |
+| `synced` | `[string, ...]` | Subsystems that were automatically updated by the sync event bus |
 
 #### Check Pending Changes
 
@@ -470,7 +476,12 @@ POST /api/dhcp/apply
 
 Write the in-memory configuration to `/etc/dnsmasq.d/vacuum-wall.conf` and reload the dnsmasq service.
 
-**Response:** `data` is `null` on success.
+**Response (`data`):**
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `applied` | `boolean` | Always `true` on success |
+| `synced` | `[string, ...]` | Subsystems that were automatically updated by the sync event bus |
 
 ### Status
 
@@ -1114,7 +1125,12 @@ POST /api/wireguard/apply
 
 Write the current configuration to `wg0.conf` and bring the tunnel up.
 
-**Response:** `data` is `null` on success.
+**Response (`data`):**
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `applied` | `boolean` | Always `true` on success |
+| `synced` | `[string, ...]` | Subsystems that were automatically updated by the sync event bus |
 
 ---
 
@@ -1138,7 +1154,12 @@ POST /api/wireguard/down
 
 Bring down the WireGuard tunnel interface (`wg0`).
 
-**Response:** `data` is `null` on success.
+**Response (`data`):**
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `down` | `boolean` | Always `true` on success |
+| `synced` | `[string, ...]` | Subsystems auto-synced as a result |
 
 ### Status
 
@@ -1329,7 +1350,8 @@ Save network config for an interface, render the `.network` file, copy it to `/e
 | Field | Type | Description |
 |-------|------|-------------|
 | `name` | `string` | Interface name |
-| `applied` | `boolean` | Always `true` on success |
+| `applied` | `boolean` | `true` if deploy to systemd-networkd succeeded, `false` if the system call was unavailable |
+| `synced` | `[string, ...]` | Subsystems that were automatically updated by the sync event bus |
 
 Returns HTTP `400` if the interface name is invalid.
 
@@ -1369,6 +1391,7 @@ Full sync: generate all `.network` files, remove stale files, copy to `/etc/syst
 | `applied` | `number` | Number of interfaces applied |
 | `files` | `[string, ...]` | Paths of generated files |
 | `cleaned` | `[string, ...]` | Paths of removed stale files |
+| `synced` | `[string, ...]` | Subsystems that were automatically updated by the sync event bus |
 
 ### Helpers