feat: add networkd subsystem and fix code review issues

Phase 1-4: Networkd subsystem
- lib/network.py: systemd-networkd config renderer (.network INI files)
  with full schema support: [Match], [Link], [Network], [Address], [Route],
  [DHCPv4], [DHCPv6] sections. One Address/=DNS= line per value per spec.
  Route sections use #N suffix per systemd.syntax(7).
- lib/network.py: generate_network_files() with 50-<name>.network prefix
  and stale file cleanup
- lib/network.py: collect_upstream_dns() filters local/private DNS
- lib/network.py: infer_dhcp_ranges() and infer_zones() helpers
- daemon/handlers/network.py: routes for GET/POST /network/interfaces
  and full apply with DNS upstream sync to dnsmasq
- webui/api/network.py: Flask blueprint for /api/network/* endpoints
- webui/api: interfaces page updated with IP config inline editing
- lib/state.py: networkd collector using parse_networkctl_status()
- system/sudoers.d/vacuum-walld: networkctl + systemd-network rules
- system/systemd/vacuum-walld.service: ReadWritePaths for /etc/systemd/network
- install.sh: ACME email now optional, configured from WebUI
- lib/acme.py: get_email() falls back to declarative config

Phase 5: Code review fixes
- daemon/server.py: path params now win over JSON body and query params
  in request body merge (prevents config save name override)
- daemon/server.py: remove dead 'import re'
- daemon/handlers/network.py: replace Path.mkdir() with sudo mkdir
  for /etc/systemd/network (ProtectSystem=strict compatibility)
- system/sudoers.d/vacuum-walld: pin systemctl to specific commands
  (reload/is-active dnsmasq instead of wildcard)
- system/sudoers.d/vacuum-walld: restore !requiretty and section comment
- lib/network.py: remove unused _MANAGEMENT_PORTS constant
- webui/api/network.py: remove redundant body[\name\] = name in save_interface

Tests: 332 passing (110 new/updated), ruff clean

docs/overview.md

@@ -2,11 +2,11 @@
 
 ## What is Vacuum Wall?
 
-Vacuum Wall is a zone-based firewall appliance with a built-in SSL reverse proxy, providing a unified platform for network security and traffic management. It combines firewalld policy control, DHCP/DNS services, WireGuard VPN tunnels, and automated certificate provisioning into a single device. A single web UI controls everything, making enterprise-grade network infrastructure manageable from one place.
+Vacuum Wall is a zone-based firewall appliance with a built-in SSL reverse proxy, providing a unified platform for network security and traffic management. It combines firewalld policy control, DHCP/DNS services, systemd-networkd for static IP management, WireGuard VPN tunnels, and automated certificate provisioning into a single device. A single web UI controls everything, making enterprise-grade network infrastructure manageable from one place.
 
 ## Architecture Overview
 
-Vacuum Wall is built around four integrated subsystems managed through a two-layer architecture: a non-privileged Flask web UI and a privileged background daemon (`vacuum-walld`). The web UI communicates with the daemon via a Unix socket. The daemon handles all privileged operations (sudo) for the subsystems: the traffic plane uses firewalld with its nftables backend (zone-based policies, source NAT, destination NAT); the DNS/DHCP plane serves private subnets via dnsmasq; the proxy plane runs nginx with automatic ACME certificates through acme.sh; and the VPN plane uses WireGuard (wg-quick) for encrypted tunnel management. All subsystems are configured and monitored through the Flask web UI, which is itself proxied through nginx with basic HTTP authentication.
+Vacuum Wall is built around five integrated subsystems managed through a two-layer architecture: a non-privileged Flask web UI and a privileged background daemon (`vacuum-walld`). The web UI communicates with the daemon via a Unix socket. The daemon handles all privileged operations (sudo) for the subsystems: the traffic plane uses firewalld with its nftables backend (zone-based policies, source NAT, destination NAT); the DNS/DHCP plane serves private subnets via dnsmasq; the network plane uses systemd-networkd for static IP management; the proxy plane runs nginx with automatic ACME certificates through acme.sh; and the VPN plane uses WireGuard (wg-quick) for encrypted tunnel management. All subsystems are configured and monitored through the Flask web UI, which is itself proxied through nginx with basic HTTP authentication.
 
 ## Subsystems
 
@@ -22,6 +22,10 @@ dnsmasq serves as both the DHCP server and local DNS resolver. It is configured
 
 The nginx reverse proxy handles HTTPS termination for user-defined domains, with certificates automatically provisioned and renewed via acme.sh and an ACME provider (ZeroSSL by default). Each proxy domain is configured with an HTTP-to-HTTPS redirect, modern TLS settings, and a configurable backend target. New proxy domains are added through the web UI, and the configuration is applied without manual intervention.
 
+### Network (systemd-networkd)
+
+The networkd subsystem manages static IP configuration for network interfaces via systemd-networkd. It renders declarative JSON configuration into per-interface `.network` INI files (`50-<name>.network`), supporting static addresses, routes, DNS, DHCP clients, link settings, and all `[Address]`, `[Route]`, `[DHCPv4]`, `[DHCPv6]`, and `[Link]` section keys. When the full apply runs, public DNS servers from networkd configs are auto-synced to dnsmasq's upstream resolvers. Helper endpoints can infer candidate DHCP ranges from static IPs and suggest firewalld zone assignments based on interface role.
+
 ### WireGuard
 
 WireGuard support provides server-side VPN tunnel management. Peers are added through the web UI, with the system generating client configuration files that can be downloaded and applied on remote devices. The dashboard displays active connections and transfer statistics for each peer, allowing operators to monitor tunnel health and usage.
@@ -31,6 +35,7 @@ WireGuard support provides server-side VPN tunnel management. Peers are added th
 - Debian 13 (trixie) target platform
 - Python 3.13+, Flask 3.x for web management
 - firewalld (nftables backend)
+- systemd-networkd (ip-lladdr, networkctl)
 - nginx 1.26+
 - dnsmasq
 - WireGuard tools (wireguard-tools)
@@ -60,6 +65,7 @@ After installation, access the management interface at `https://<hostname>.local
 ├── .venv/                   # Python virtual environment
 ├── config/                  # Declarative JSON configuration (source of truth)
 │   ├── dnsmasq/             # DHCP/DNS config
+│   ├── network/             # systemd-networkd per-interface config
 │   ├── firewall/            # Firewall zone & rule config
 │   ├── nginx/               # Proxy domain & SSL config
 │   └── wireguard/           # VPN interface & peer config
@@ -69,11 +75,13 @@ After installation, access the management interface at `https://<hostname>.local
 │   ├── acme/                # ACME certificates
 │   ├── firewall/            # Firewall rule backup
 │   ├── logs/                # Application logs
+│   ├── networkd/            # Generated 50-<name>.network files
 │   └── wireguard/           # Generated WireGuard configs
 ├── daemon/                  # Privileged background daemon
 │   ├── server.py            # aiohttp server, cache, batch routing, handler registry
 │   ├── client.py            # Sync HTTP client over Unix socket
-│   └── handlers/            # Privileged operation handlers (all sudo calls)
+│   ├── handlers/            # Privileged operation handlers (all sudo calls)
+│   │   └── network.py       # networkd handler (generate + apply)
 ├── system/                  # System file templates (all Jinja2)
 │   ├── systemd/             # Service and timer unit files
 │   │   ├── vacuum-wall.service        # Web UI service (rendered at install)
@@ -87,8 +95,10 @@ After installation, access the management interface at `https://<hostname>.local
 │   ├── common.py            # Shared utilities (run, run_proc, load_json, save_json, deep_merge, ensure_dirs)
 │   ├── logging.py           # Logging setup
 │   ├── firewall.py          # firewalld bindings
+│   ├── network.py           # systemd-networkd rendering & parsing
 │   ├── dnsmasq.py           # DHCP/DNS configuration
 │   ├── nginx.py             # Reverse proxy configuration
+│   ├── state.py             # State collector (uses lib.network.parse_networkctl_status)
 │   ├── acme.py              # Certificate management
 │   └── wireguard.py         # VPN tunnel management
 ├── webui/                   # Flask web application
@@ -100,6 +110,7 @@ After installation, access the management interface at `https://<hostname>.local
 │   │   ├── proxy.py         # Nginx proxy API
 │   │   ├── certs.py         # Certificate API
 │   │   ├── wireguard.py     # WireGuard API
+│   │   ├── network.py       # Networkd API
 │   │   └── logs.py          # Logs API
 │   ├── templates/           # Jinja2/HTMX templates
 │   └── static/              # CSS and client-side JS