refactor: unify project structure, improve security, and enhance deployment

- Fix WireGuard private key leak in API responses and config updates
- Update systemd service to serve from repo root with adjusted sandbox
- Add CLI flags, idempotency, and dev mode to install.sh
- Extract common utilities to lib/common.py and webui/api/common.py
- Migrate frontend to htmx for simpler, more maintainable UI
- Update docs to reflect current architecture and deployment model
- Vendor htmx dependencies per project requirements

docs/config.md

@@ -107,7 +107,7 @@ This file defines reverse proxy domains, the management interface, and global SS
     },
     "auth": {
       "user": "admin",
-      "htpasswd": "$PROJECT_DIR/data/nginx/.htpasswd"
+      "htpasswd": "data/nginx/.htpasswd"
     }
   },
   "ssl": {
@@ -142,7 +142,7 @@ The `domains` object maps domain names (keys) to proxy configurations. Each entr
 |---|---|
 | `acme` | Vacuum Wall uses acme.sh to request and renew an ACME certificate via the HTTP-01 challenge. The nginx configuration is temporarily modified to serve the ACME challenge files at `/.well-known/acme-challenge/`. The `email` field is required. |
 | `file` | Use a pre-existing certificate and private key from the local file system. The `path` and `key_path` fields must point to readable PEM files. Vacuum Wall will not attempt to renew these certificates. |
-| `selfsigned` | Vacuum Wall generates a self-signed certificate and private key on first apply. Useful for internal domains or testing. The generated certificate is stored at `$PROJECT_DIR/data/certs/`. |
+| `selfsigned` | Vacuum Wall generates a self-signed certificate and private key on first apply. Useful for internal domains or testing. The generated certificate is stored at `data/certs/`. |
 
 ### Management Domain
 
@@ -159,7 +159,7 @@ The `management` block configures the Vacuum Wall admin interface itself. It fol
 The `.htpasswd` file can be created with the `htpasswd` utility:
 
 ```bash
-htpasswd -bc $PROJECT_DIR/data/nginx/.htpasswd admin yourpassword
+htpasswd -bc data/nginx/.htpasswd admin yourpassword
 ```
 
 ### Global SSL Settings