refactor: unify project structure, improve security, and enhance deployment

- Fix WireGuard private key leak in API responses and config updates
- Update systemd service to serve from repo root with adjusted sandbox
- Add CLI flags, idempotency, and dev mode to install.sh
- Extract common utilities to lib/common.py and webui/api/common.py
- Migrate frontend to htmx for simpler, more maintainable UI
- Update docs to reflect current architecture and deployment model
- Vendor htmx dependencies per project requirements

webui/api/wireguard.py

@@ -53,9 +53,17 @@ def post_config():
     if not isinstance(body, dict):
         return _error("Request body must be a JSON object", 400)
     try:
+        # Preserve existing server private key through full replacement
+        current = get_config()
+        current_key = current.get("interface", {}).get("private_key", "")
+
         if "interface" in body:
             body["interface"] = dict(body["interface"])
             body["interface"].pop("private_key", None)
+
+        if current_key:
+            body.setdefault("interface", {})["private_key"] = current_key
+
         save_config(body)
         return _ok(None)
     except RuntimeError as exc: