docs: add comprehensive docstrings and inline comments

Add docstrings to all handler functions in daemon/handlers/firewall.py, covering
params, return values, and raised exceptions. Add inline comments to
_config_apply() reconciliation steps and the request body merge order.

Add docstrings across lib/ modules for emit helpers (_emit_str, _emit_int, etc.),
volatile stripping logic, two-layer diff strategy, sync event dispatch, and all
cross-subsystem sync subscribers (DnsToFirewall, WgToFirewall, FirewallToDhcp,
NetworkToAllSync).

Document WireGuard/networkd config parsers and key-value mappers in
system_import.py. Add docstrings to _ep(), Registry.decorator,
setup_logging, and _replace helper across daemon/ and lib/.

daemon/server.py

@@ -102,6 +102,7 @@ class Registry:
             method = ep_method
 
         def decorator(fn: Callable) -> Callable:
+            """Inner decorator that stores *fn* in the registry and attaches Handler metadata."""
             self._routes[(method.upper(), path)] = fn  # type: ignore[arg-type]
             fn._handler = Handler(method, path)  # type: ignore[attr-defined,reportArgumentType]
             return fn
@@ -236,7 +237,8 @@ async def _handle_request(request: web.Request) -> web.Response:
 
     # Build body — merge order (highest wins): path params > JSON body > query params.
     # Path params come from the URL path (e.g. /interfaces/eth0) and should not
-    # be overridable by body or query parameters.
+    # be overridable by body or query parameters. This prevents callers from
+    # spoofing path-scoped parameters via request body.
     body: dict[str, Any] | None = pat_params if pat_params else None
     if request.content_type == "application/json":
         try: