refactor: unify project structure, improve security, and enhance deployment

- Fix WireGuard private key leak in API responses and config updates
- Update systemd service to serve from repo root with adjusted sandbox
- Add CLI flags, idempotency, and dev mode to install.sh
- Extract common utilities to lib/common.py and webui/api/common.py
- Migrate frontend to htmx for simpler, more maintainable UI
- Update docs to reflect current architecture and deployment model
- Vendor htmx dependencies per project requirements

tests/test_wireguard.py

@@ -31,18 +31,22 @@ class TestGetConfig:
         assert cfg["peers"] == {}
 
     def test_loads_existing_config(self, temp_config):
-        wireguard.CONFIG_PATH.write_text(json.dumps({
-            "interface": {
-                "name": "wg0",
-                "listen_port": 51820,
-                "private_key": "existing-key",
-                "public_key": "existing-pub",
-                "addresses": ["10.137.0.1/24"],
-                "post_up": None,
-                "post_down": None,
-            },
-            "peers": {},
-        }))
+        wireguard.CONFIG_PATH.write_text(
+            json.dumps(
+                {
+                    "interface": {
+                        "name": "wg0",
+                        "listen_port": 51820,
+                        "private_key": "existing-key",
+                        "public_key": "existing-pub",
+                        "addresses": ["10.137.0.1/24"],
+                        "post_up": None,
+                        "post_down": None,
+                    },
+                    "peers": {},
+                }
+            )
+        )
         cfg = wireguard.get_config()
         assert cfg["interface"]["private_key"] == "existing-key"
 
@@ -110,7 +114,7 @@ class TestAddPeer:
         mock_gen.return_value = ("priv", "pub")
         result = wireguard.add_peer("client1", allowed_ips=["10.0.0.0/24"])
         assert result["public_key"] == "pub"
-        assert result["private_key"] == "priv"
+        assert "private_key" not in result
         assert result["allowed_ips"] == ["10.0.0.0/24"]
 
     @patch("lib.wireguard.generate_keypair")