refactor: unify project structure, improve security, and enhance deployment

- Fix WireGuard private key leak in API responses and config updates
- Update systemd service to serve from repo root with adjusted sandbox
- Add CLI flags, idempotency, and dev mode to install.sh
- Extract common utilities to lib/common.py and webui/api/common.py
- Migrate frontend to htmx for simpler, more maintainable UI
- Update docs to reflect current architecture and deployment model
- Vendor htmx dependencies per project requirements

tests/test_dnsmasq.py

@@ -2,7 +2,7 @@ from unittest.mock import patch
 
 import pytest
 
-from lib import dnsmasq
+from lib import common, dnsmasq
 
 
 @pytest.fixture
@@ -29,24 +29,24 @@ class TestDeepMerge:
     def test_merge_flat_dicts(self):
         base = {"a": 1, "b": 2}
         override = {"b": 3, "c": 4}
-        result = dnsmasq._deep_merge(base, override)
+        result = common.deep_merge(base, override)
         assert result == {"a": 1, "b": 3, "c": 4}
 
     def test_merge_nested_dicts(self):
         base = {"a": {"x": 1, "y": 2}}
         override = {"a": {"y": 3, "z": 4}}
-        result = dnsmasq._deep_merge(base, override)
+        result = common.deep_merge(base, override)
         assert result == {"a": {"x": 1, "y": 3, "z": 4}}
 
     def test_merge_non_dict_override(self):
         base = {"a": {"x": 1}}
         override = {"a": "flat"}
-        result = dnsmasq._deep_merge(base, override)
+        result = common.deep_merge(base, override)
         assert result == {"a": "flat"}
 
 
 class TestGetConfig:
-    @patch("lib.dnsmasq._load_json")
+    @patch("lib.dnsmasq.load_json")
     def test_returns_default_when_no_config(self, mock_load, temp_data_dir):
         mock_load.return_value = {}
         result = dnsmasq.get_config()
@@ -54,7 +54,7 @@ class TestGetConfig:
         assert "dns" in result
         assert result["dns"]["upstreams"] == ["8.8.8.8", "1.1.1.1"]
 
-    @patch("lib.dnsmasq._load_json")
+    @patch("lib.dnsmasq.load_json")
     def test_merges_with_existing_config(self, mock_load, temp_data_dir):
         mock_load.return_value = {"dns": {"upstreams": ["9.9.9.9"]}}
         result = dnsmasq.get_config()