refactor: unify project structure, improve security, and enhance deployment

- Fix WireGuard private key leak in API responses and config updates
- Update systemd service to serve from repo root with adjusted sandbox
- Add CLI flags, idempotency, and dev mode to install.sh
- Extract common utilities to lib/common.py and webui/api/common.py
- Migrate frontend to htmx for simpler, more maintainable UI
- Update docs to reflect current architecture and deployment model
- Vendor htmx dependencies per project requirements

tests/test_nginx.py

@@ -200,7 +200,7 @@ class TestWriteAllSites:
 
 
 class TestTestConfig:
-    @patch("lib.nginx._run")
+    @patch("lib.nginx.subprocess.run")
     def test_passes(self, mock_run, temp_data_dir):
         mock_run.return_value = MagicMock(
             returncode=0, stdout="", stderr="test passed\n"
@@ -208,7 +208,7 @@ class TestTestConfig:
         ok, _msg = nginx.test_config()
         assert ok is True
 
-    @patch("lib.nginx._run")
+    @patch("lib.nginx.subprocess.run")
     def test_fails(self, mock_run, temp_data_dir):
         mock_run.return_value = MagicMock(
             returncode=1, stdout="", stderr="nginx: configuration test failed\n"