refactor: unify project structure, improve security, and enhance deployment

- Fix WireGuard private key leak in API responses and config updates
- Update systemd service to serve from repo root with adjusted sandbox
- Add CLI flags, idempotency, and dev mode to install.sh
- Extract common utilities to lib/common.py and webui/api/common.py
- Migrate frontend to htmx for simpler, more maintainable UI
- Update docs to reflect current architecture and deployment model
- Vendor htmx dependencies per project requirements

system/systemd/vacuum-wall.service

@@ -20,7 +20,7 @@ Environment=HOME={{ PROJECT_DIR }}
 # Security hardening
 NoNewPrivileges=yes
 ProtectSystem=strict
-ReadWritePaths={{ PROJECT_DIR }}/config {{ PROJECT_DIR }}/data /tmp
+ReadWritePaths={{ PROJECT_DIR }} {{ PROJECT_DIR }}/config {{ PROJECT_DIR }}/data /tmp
 PrivateTmp=yes
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
@@ -34,9 +34,8 @@ LockPersonality=yes
 SystemCallFilter=@system-service
 PrivateDevices=yes
 
-ProtectHome=read-only
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-IPAddressDeny=all
+IPAddressDeny=any
 IPAddressAllow=localhost
 
 [Install]