refactor: unify project structure, improve security, and enhance deployment

- Fix WireGuard private key leak in API responses and config updates
- Update systemd service to serve from repo root with adjusted sandbox
- Add CLI flags, idempotency, and dev mode to install.sh
- Extract common utilities to lib/common.py and webui/api/common.py
- Migrate frontend to htmx for simpler, more maintainable UI
- Update docs to reflect current architecture and deployment model
- Vendor htmx dependencies per project requirements

webui/server.py

@@ -19,12 +19,15 @@ from lib.dnsmasq import get_config as dnsmasq_config
 from lib.dnsmasq import get_lease_table
 from lib.dnsmasq import get_status as dnsmasq_status
 from lib.firewall import (
-    config_get,
     config_pending,
     get_active_zones,
     get_interfaces,
+    get_services,
     get_zone_info,
 )
+from lib.firewall import (
+    get_config as fw_config_get,
+)
 from lib.logging import setup_logging
 from lib.nginx import get_config as nginx_config
 from lib.nginx import get_domains
@@ -220,14 +223,14 @@ def dashboard():
         certs=certs,
         wg_status=wg,
         services=_get_service_status(dnsmasq, wg),
-        firewall_config=_safely(config_get, {}),
+        firewall_config=_safely(fw_config_get, {}),
         firewall_pending=_safely(config_pending, {}),
     )
 
 
 @app.route("/interfaces")
 def interfaces_page():
-    firewall_config = _safely(config_get, {})
+    firewall_config = _safely(fw_config_get, {})
     firewall_pending = _safely(config_pending, {})
     return render_template(
         "interfaces.html",
@@ -240,7 +243,7 @@ def interfaces_page():
 
 @app.route("/zones")
 def zones_page():
-    firewall_config = _safely(config_get, {})
+    firewall_config = _safely(fw_config_get, {})
     firewall_pending = _safely(config_pending, {})
     zones_data = {}
     for name in _safely(get_active_zones, {}):
@@ -249,12 +252,7 @@ def zones_page():
         "zones.html",
         zones=zones_data,
         interfaces=_safely(get_interfaces, []),
-        services=_safely(
-            lambda: __import__(
-                "lib.firewall", fromlist=["get_services"]
-            ).get_services(),
-            [],
-        ),
+        services=_safely(get_services, []),
         firewall_config=firewall_config,
         firewall_pending=firewall_pending,
     )
@@ -263,7 +261,7 @@ def zones_page():
 @app.route("/rules")
 def rules_page():
     zones = list(_safely(get_active_zones, {}).keys())
-    raw = _safely(config_get, {})
+    raw = _safely(fw_config_get, {})
     rules = {}
     for zname, zcfg in raw.get("zones", {}).items():
         rr = zcfg.get("rich_rules", [])