refactor: unify project structure, improve security, and enhance deployment

- Fix WireGuard private key leak in API responses and config updates
- Update systemd service to serve from repo root with adjusted sandbox
- Add CLI flags, idempotency, and dev mode to install.sh
- Extract common utilities to lib/common.py and webui/api/common.py
- Migrate frontend to htmx for simpler, more maintainable UI
- Update docs to reflect current architecture and deployment model
- Vendor htmx dependencies per project requirements

system/nginx/server_block.conf

@@ -7,6 +7,11 @@ server {
     listen [::]:80;
     server_name {{ domain }};
 
+    # ACME HTTP-01 challenge
+    location /.well-known/acme-challenge/ {
+        root {{ acme_webroot }};
+    }
+
     # Redirect all HTTP traffic to HTTPS
     return 301 https://$host$request_uri;
 }