docs: update all documentation and AGENTS.md

docs/security.md

@@ -53,6 +53,10 @@ Key safety properties:
 - `NOPASSWD` is used so the application never prompts for a password. `Defaults:<user>` restricts the secure path and disables TTY requirement.
 - The sudoers file is rendered from a Jinja2 template at install time, substituting the configured user name.
 
+## Daemon Client Path Resolution
+
+The `daemon/client.py` module resolves `<param>` placeholders in URL paths before sending requests over the Unix socket. For example, a request to `/network/interfaces/<name>` with a body containing `{"name": "eth0"}` is rewritten to `/network/interfaces/eth0` before transmission. Parameter values are URL-encoded to handle special characters safely. This eliminates the need for the API layer to construct literal paths and ensures the daemon always receives concrete paths for routing.
+
 ## Web Security
 
 ### Management Interface
@@ -135,6 +139,15 @@ The `lib/firewall` module is a generic firewalld parser with no hardcoded zone d
 
 IP forwarding (`net.ipv4.ip_forward = 1`) is enabled system-wide to allow routing between zones (LAN to Internet, VPN to LAN). However, actual traffic flow is controlled by firewalld rules. Masquerade is enabled on the `internal` zone so that LAN clients get NAT translation when accessing the Internet through the Vacuum Wall router.
 
+## Input Validation
+
+Interface names provided via the API are validated at two layers before any file system access or subprocess invocation:
+
+- **API layer** (`webui/api/network.py`): The Flask route calls `validate_interface_name()` from `lib/common.py`, rejecting any name that doesn't match `^[a-zA-Z0-9][a-zA-Z0-9._-]*$`. Names containing `/`, `..`, spaces, or other disallowed characters return HTTP `400`.
+- **Daemon handler layer** (`daemon/handlers/network.py`): Each handler re-validates the name from the request body using the same function. An invalid name raises `ValueError`, which the daemon converts to an error response before any `sudo` call.
+
+This defense-in-depth approach ensures that even if a request bypasses the API layer, the daemon will still reject malicious interface names.
+
 ## Certificate Security
 
 ### acme.sh Integration