refactor: unify project structure, improve security, and enhance deployment

- Fix WireGuard private key leak in API responses and config updates
- Update systemd service to serve from repo root with adjusted sandbox
- Add CLI flags, idempotency, and dev mode to install.sh
- Extract common utilities to lib/common.py and webui/api/common.py
- Migrate frontend to htmx for simpler, more maintainable UI
- Update docs to reflect current architecture and deployment model
- Vendor htmx dependencies per project requirements

docs/api.md

@@ -103,9 +103,16 @@ Compare declarative config against live firewalld state. Returns diff for interf
 PATCH /api/firewall/config
 ```
 
-Deep-merge the provided fields into the existing config.
+Deep-merge the provided fields into the existing config. Returns pending changes summary.
 
-**Response:** `data` is `null` on success.
+**Response (`data`):**
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `config_saved` | `boolean` | Always `true` |
+| `pending` | `[object, ...]` | List of pending changes |
+| `needs_apply` | `boolean` | Whether changes need to be applied |
+| `unmanaged_zones` | `object` | Zones active on system but not in config |
 
 ### Zone Management
 
@@ -927,6 +934,24 @@ Replace the entire WireGuard configuration. The `private_key` field is stripped
 
 **Response:** `data` contains the updated configuration (`private_key` omitted).
 
+---
+
+#### Partial Update Configuration
+
+```
+PATCH /api/wireguard/config
+```
+
+Deep-merge the provided fields into the existing configuration.
+
+**Request Body:**
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| *(any subset)* | `any` | Yes | Fields to merge into the existing config |
+
+**Response:** `data` is `null` on success.
+
 ### Tunnel Control
 
 #### Apply Configuration