docs: add comprehensive docstrings and inline comments

Add docstrings to all handler functions in daemon/handlers/firewall.py, covering
params, return values, and raised exceptions. Add inline comments to
_config_apply() reconciliation steps and the request body merge order.

Add docstrings across lib/ modules for emit helpers (_emit_str, _emit_int, etc.),
volatile stripping logic, two-layer diff strategy, sync event dispatch, and all
cross-subsystem sync subscribers (DnsToFirewall, WgToFirewall, FirewallToDhcp,
NetworkToAllSync).

Document WireGuard/networkd config parsers and key-value mappers in
system_import.py. Add docstrings to _ep(), Registry.decorator,
setup_logging, and _replace helper across daemon/ and lib/.

lib/network.py

@@ -103,30 +103,73 @@ def save_config(cfg: dict[str, Any]) -> None:
 
 
 def _emit_str(lines: list[str], key: str, py_key: str, d: dict[str, Any]) -> None:
+    """Append a ``Key=Value`` line to *lines* if *py_key* has a non-None value in *d*.
+
+    Args:
+        lines: Target list to append rendered line to.
+        key: INI key name for the output line.
+        py_key: Python dict key to look up in *d*.
+        d: Config entry dict to extract value from.
+    """
     v = d.get(py_key)
     if v is not None:
         lines.append(f"{key}={v}")
 
 
 def _emit_int(lines: list[str], key: str, py_key: str, d: dict[str, Any]) -> None:
+    """Append a ``Key=Value`` line to *lines* for integer values.
+
+    Args:
+        lines: Target list to append rendered line to.
+        key: INI key name for the output line.
+        py_key: Python dict key to look up in *d*.
+        d: Config entry dict to extract value from.
+    """
     v = d.get(py_key)
     if v is not None:
         lines.append(f"{key}={v}")
 
 
 def _emit_bool(lines: list[str], key: str, py_key: str, d: dict[str, Any]) -> None:
+    """Append a ``Key=yes/no`` line to *lines* if *py_key* has a non-None value in *d*.
+
+    Args:
+        lines: Target list to append rendered line to.
+        key: INI key name for the output line.
+        py_key: Python dict key to look up in *d*.
+        d: Config entry dict to extract value from.
+    """
     v = d.get(py_key)
     if v is not None:
         lines.append(f"{key}={'yes' if v else 'no'}")
 
 
 def _emit_bool_opt(lines: list[str], key: str, py_key: str, d: dict[str, Any]) -> None:
+    """Identical to :func:`_emit_bool` — kept for API compatibility.
+
+    Args:
+        lines: Target list to append rendered line to.
+        key: INI key name for the output line.
+        py_key: Python dict key to look up in *d*.
+        d: Config entry dict to extract value from.
+    """
     v = d.get(py_key)
     if v is not None:
         lines.append(f"{key}={'yes' if v else 'no'}")
 
 
 def _emit_any(lines: list[str], key: str, py_key: str, d: dict[str, Any]) -> None:
+    """Append a ``Key=Value`` line handling both bool and non-bool types.
+
+    Boolean values are rendered as ``yes``/``no``; all other types are
+    stringified directly.
+
+    Args:
+        lines: Target list to append rendered line to.
+        key: INI key name for the output line.
+        py_key: Python dict key to look up in *d*.
+        d: Config entry dict to extract value from.
+    """
     v = d.get(py_key)
     if v is not None:
         if isinstance(v, bool):
@@ -570,6 +613,18 @@ _IS_LOCAL = [
 
 
 def _is_local_dns(addr: str) -> bool:
+    """Return ``True`` if *addr* falls within a local/private IP range.
+
+    Checks loopback, RFC 1918 (10/8, 172.16/12, 192.168/16), link-local
+    (169.254/16), and their IPv6 equivalents (fc00::/7, fe80::/10).
+
+    Args:
+        addr: IP address string to test.
+
+    Returns:
+        ``True`` if the address is local/private, ``False`` otherwise.
+        Invalid addresses are treated as non-local.
+    """
     try:
         ip = ipaddress.ip_address(addr)
         for net in _IS_LOCAL: