refactor: unify project structure, improve security, and enhance deployment

- Fix WireGuard private key leak in API responses and config updates
- Update systemd service to serve from repo root with adjusted sandbox
- Add CLI flags, idempotency, and dev mode to install.sh
- Extract common utilities to lib/common.py and webui/api/common.py
- Migrate frontend to htmx for simpler, more maintainable UI
- Update docs to reflect current architecture and deployment model
- Vendor htmx dependencies per project requirements

webui/api/certs.py

@@ -1,12 +1,11 @@
-"""
-webui/api/certs.py - ACME certificate management API blueprint.
+"""ACME certificate management API blueprint.
 
 Exposed at /api/certs/* and delegates to lib.acme.
 """
 
 import logging
 
-from flask import Blueprint, jsonify, request
+from flask import Blueprint, request
 
 from lib.acme import (
     get_cert_info,
@@ -16,24 +15,12 @@ from lib.acme import (
     renew,
     set_email,
 )
+from webui.api.common import _error, _ok
 
 logger = logging.getLogger(__name__)
 bp = Blueprint("certs", __name__)
 
 
-# ---------------------------------------------------------------------------
-# Helpers
-# ---------------------------------------------------------------------------
-
-
-def _error(msg, code=400):
-    return jsonify({"ok": False, "error": msg}), code
-
-
-def _ok(data=None):
-    return jsonify({"ok": True, "data": data})
-
-
 # ---------------------------------------------------------------------------
 # Certificate listing
 # ---------------------------------------------------------------------------
@@ -43,19 +30,19 @@ def _ok(data=None):
 def list_certs_bp():
     try:
         return _ok(list_certs())
-    except RuntimeError as exc:
+    except (RuntimeError, FileNotFoundError) as exc:
         logger.error("Failed to list certificates: %s", exc)
         return _error(str(exc), 500)
 
 
 @bp.route("/<domain>", methods=["GET"])
-def cert_details(domain):
+def cert_details(domain: str):
     try:
         info = get_cert_info(domain)
         return _ok(info)
     except ValueError as exc:
         return _error(str(exc), 404)
-    except RuntimeError as exc:
+    except (RuntimeError, FileNotFoundError) as exc:
         logger.error("Failed to get cert info for '%s': %s", domain, exc)
         return _error(str(exc), 500)
 
@@ -72,18 +59,14 @@ def issue_bp():
     if not domain:
         return _error("'domain' is required", 400)
     webroot = body.get("webroot")
+    email = body.get("email", "").strip() or None
     try:
         logger.info("Certificate issuance requested for '%s' via API", domain)
-        result = issue(domain, webroot=webroot)
-        if result.get("success"):
-            logger.info("Certificate issued for '%s'", domain)
-            return _ok(None)
-        logger.error(
-            "Certificate issuance failed for '%s': %s", domain, result.get("error")
-        )
-        return _error(result.get("error", "Unknown error"), 500)
-    except RuntimeError as exc:
-        logger.error("Exception issuing cert for '%s': %s", domain, exc)
+        issue(domain, webroot=webroot, email=email)
+        logger.info("Certificate issued for '%s'", domain)
+        return _ok(None)
+    except (RuntimeError, FileNotFoundError) as exc:
+        logger.error("Failed to issue cert for '%s': %s", domain, exc)
         return _error(str(exc), 500)
 
 
@@ -93,19 +76,14 @@ def issue_bp():
 
 
 @bp.route("/<domain>/renew", methods=["POST"])
-def renew_bp(domain):
+def renew_bp(domain: str):
     try:
         logger.info("Certificate renewal requested for '%s' via API", domain)
-        result = renew(domain)
-        if result.get("success"):
-            logger.info("Certificate renewed for '%s'", domain)
-            return _ok(None)
-        logger.error(
-            "Certificate renewal failed for '%s': %s", domain, result.get("error")
-        )
-        return _error(result.get("error", "Unknown error"), 500)
-    except RuntimeError as exc:
-        logger.error("Exception renewing cert for '%s': %s", domain, exc)
+        renew(domain)
+        logger.info("Certificate renewed for '%s'", domain)
+        return _ok(None)
+    except (RuntimeError, FileNotFoundError) as exc:
+        logger.error("Failed to renew cert for '%s': %s", domain, exc)
         return _error(str(exc), 500)
 
 
@@ -115,19 +93,19 @@ def renew_bp(domain):
 
 
 @bp.route("/<domain>", methods=["DELETE"])
-def remove_bp(domain):
+def remove_bp(domain: str):
     try:
         get_cert_info(domain)
     except ValueError as exc:
         return _error(str(exc), 404)
-    except RuntimeError as exc:
+    except (RuntimeError, FileNotFoundError) as exc:
         logger.error("Failed to verify cert '%s': %s", domain, exc)
         return _error(str(exc), 500)
     try:
         remove(domain)
         logger.info("Certificate removed for '%s' via API", domain)
         return _ok(None)
-    except RuntimeError as exc:
+    except (RuntimeError, FileNotFoundError) as exc:
         logger.error("Failed to remove cert '%s': %s", domain, exc)
         return _error(str(exc), 500)
 
@@ -147,6 +125,6 @@ def set_email_bp():
         set_email(email)
         logger.info("ACME email set via API: %s", email)
         return _ok({"email": email})
-    except RuntimeError as exc:
+    except (RuntimeError, FileNotFoundError) as exc:
         logger.error("Failed to set ACME email: %s", exc)
         return _error(str(exc), 500)