refactor: unify project structure, improve security, and enhance deployment

- Fix WireGuard private key leak in API responses and config updates
- Update systemd service to serve from repo root with adjusted sandbox
- Add CLI flags, idempotency, and dev mode to install.sh
- Extract common utilities to lib/common.py and webui/api/common.py
- Migrate frontend to htmx for simpler, more maintainable UI
- Update docs to reflect current architecture and deployment model
- Vendor htmx dependencies per project requirements

webui/api/proxy.py

@@ -6,34 +6,81 @@ Exposed at /api/proxy/* and delegates to lib.nginx.
 
 import logging
 
-from flask import Blueprint, jsonify, request
+from flask import Blueprint, request
 
+from lib.common import deep_merge
 from lib.nginx import (
     add_domain,
     apply,
     get_config,
     get_domains,
     remove_domain,
+    save_config,
     set_management_proxy,
     test_config,
     update_domain,
+    write_ssl_snippet,
 )
+from webui.api.common import _error, _ok
 
 logger = logging.getLogger(__name__)
 bp = Blueprint("proxy", __name__)
 
 
+@bp.route("/ssl-apply", methods=["POST"])
+def ssl_apply_bp():
+    """Apply (write) the global SSL snippet for all Nginx server blocks."""
+    try:
+        write_ssl_snippet()
+        logger.info("SSL snippet written via API")
+        return _ok(None)
+    except RuntimeError as exc:
+        logger.error("Failed to write SSL snippet: %s", exc)
+        return _error(str(exc), 500)
+
+
 # ---------------------------------------------------------------------------
-# Helpers
+# Config (declarative)
 # ---------------------------------------------------------------------------
 
 
-def _error(msg, code=400):
-    return jsonify({"ok": False, "error": msg}), code
+@bp.route("/config", methods=["GET"])
+def get_config_bp():
+    try:
+        return _ok(get_config())
+    except RuntimeError as exc:
+        logger.error("Failed to read proxy config: %s", exc)
+        return _error(str(exc), 500)
 
 
-def _ok(data=None):
-    return jsonify({"ok": True, "data": data})
+@bp.route("/config", methods=["POST"])
+def post_config():
+    body = request.get_json(silent=True) or {}
+    if not isinstance(body, dict):
+        return _error("Request body must be a JSON object", 400)
+    try:
+        save_config(body)
+        logger.info("Proxy config saved: %s", sorted(body.keys()))
+        return _ok(None)
+    except RuntimeError as exc:
+        logger.error("Failed to save proxy config: %s", exc)
+        return _error(str(exc), 500)
+
+
+@bp.route("/config", methods=["PATCH"])
+def patch_config():
+    body = request.get_json(silent=True) or {}
+    if not isinstance(body, dict):
+        return _error("Request body must be a JSON object", 400)
+    try:
+        current = get_config()
+        merged = deep_merge(current, body)
+        save_config(merged)
+        logger.info("Proxy config patched: %s", sorted(body.keys()))
+        return _ok(None)
+    except RuntimeError as exc:
+        logger.error("Failed to patch proxy config: %s", exc)
+        return _error(str(exc), 500)
 
 
 # ---------------------------------------------------------------------------