docs: update API conflict status, ACME config, request flow, deployment, and security sudoers

docs/security.md

@@ -7,7 +7,7 @@ Vacuum Wall uses two distinct system users bridged by a shared group (the WebUI
 - **`vacuum-walld`** (daemon user): Runs the `vacuum-walld` background daemon, which is the only process with sudo access. The daemon communicates with the WebUI over a Unix socket at `data/daemon.sock`. All privileged operations — firewall rule changes, nginx reloads, dnsmasq config writes, WireGuard tunnel management — are executed by the daemon through a restricted sudo whitelist at `/etc/sudoers.d/vacuum-walld`.
 - **WebUI user** (default: repo owner in `--dev` mode): Runs the Flask management WebUI. Has **zero** sudo access. If the WebUI process is compromised, an attacker cannot invoke sudo directly — they are confined to the sandboxed Flask process with no privilege escalation path.
 
-ACME certificate operations via `acme.sh` run as the WebUI user — not as root, and not as the daemon user. The automated renewal timer (`vacuum-wall-acme.timer`) runs `acme.sh --cron` as `{{ USER_NAME }}`. When triggered from the WebUI or daemon, acme.sh also runs as the non-root process invoking it, using webroot validation that does not require binding to privileged ports.
+ACME certificate operations via `acme.sh` run as the daemon user — not as root. The automated renewal timer (`vacuum-wall-acme.timer`) runs `acme.sh --cron` as `{{ USER_NAME }}`. When triggered from the WebUI or daemon, acme.sh runs as the daemon process invoking it, using webroot validation that does not require binding to privileged ports.
 
 This design follows the principle of least privilege: only the daemon process holds sudo access, and only for explicitly enumerated commands. The WebUI user is completely isolated from sudo.
 
@@ -24,25 +24,32 @@ The file `/etc/sudoers.d/vacuum-walld` grants the daemon user (`vacuum-walld`) p
 | Firewall | `firewall-cmd *` | All firewalld operations (zone management, rules, services, ports) |
 | Nginx | `nginx -s reload` | Graceful nginx configuration reload |
 | Nginx | `nginx -t` | Nginx configuration syntax validation |
-| Nginx file ops | `cp -- * /etc/nginx/`, `/etc/nginx/conf.d/`, `/etc/nginx/snippets/` | Copy rendered config files to system paths |
+| Nginx file ops | `cp -- * /etc/nginx/*` | Copy rendered config files to system paths |
+| Nginx file ops | `cp -- * /etc/nginx/conf.d/*` | Copy rendered config files to system paths |
+| Nginx file ops | `cp -- * /etc/nginx/snippets/*` | Copy rendered config files to system paths |
 | Nginx file ops | `rm /etc/nginx/conf.d/vacuum-wall.conf`, `/etc/nginx/snippets/vacuum-wall-ssl.conf` | Clean up generated nginx config files |
-| Nginx file ops | `chown root:root /etc/nginx/snippets/vacuum-wall-ssl.conf` | Ensure correct ownership of SSL snippet |
+| Nginx file ops | `chown root:root /etc/nginx/conf.d/vacuum-wall.conf`, `/etc/nginx/snippets/vacuum-wall-ssl.conf` | Ensure correct ownership of nginx config files |
 | Dnsmasq | `systemctl reload dnsmasq` | Apply updated dnsmasq configuration |
 | Dnsmasq | `systemctl is-active dnsmasq` | Check dnsmasq service status |
-| Dnsmasq file ops | `cp -- * /etc/dnsmasq.d/` | Copy rendered config files |
+| Networkd | `systemctl is-active dnsmasq` | Check dnsmasq service status |
 | Dnsmasq file ops | `tee /etc/dnsmasq.d/vacuum-wall.conf` | Write dnsmasq configuration |
 | Dnsmasq file ops | `mkdir -p /etc/dnsmasq.d` | Ensure target directory exists |
+| Dnsmasq file ops | `cp -- * /etc/dnsmasq.d/*` | Copy rendered config files |
 | Dnsmasq leases | `cat /var/lib/dnsmasq/dnsmasq.leases` | Read dnsmasq lease table |
 | WireGuard | `wg-quick *` | WireGuard tunnel lifecycle (up, down, save, show) |
 | WireGuard | `wg *` | WireGuard status and peer management |
-| WireGuard file ops | `cp -- * /etc/wireguard/` | Copy rendered config files |
+| WireGuard file ops | `cp -- * /etc/wireguard/*` | Copy rendered config files |
 | WireGuard file ops | `chown root:root /etc/wireguard/wg0.conf` | Ensure correct ownership of WG config |
-| Certificates | (none) | acme.sh runs as the non-root service user directly; no sudo escalation is needed (webroot validation is used) |
+| Certificates | (none) | acme.sh runs as the non-root daemon user directly; no sudo escalation is needed (webroot validation is used) |
 | Network queries | `ip -o link show` | List network interfaces |
 | Network queries | `ip -o addr show` | List IP addresses on interfaces |
 | Networkd | `networkctl status *` | Query interface status from networkd |
 | Networkd | `networkctl reload *` | Reload networkd for a specific interface |
 | Networkd | `networkctl reload` | Reload networkd for all interfaces |
+| Networkd file ops | `cp -- * /etc/systemd/network/*` | Copy rendered network unit files |
+| Networkd file ops | `rm /etc/systemd/network/*.network` | Remove stale network unit files |
+| Networkd file ops | `mkdir -p /etc/systemd/network` | Ensure target directory exists |
+| Sysctl | `sysctl -w *` | Set kernel parameters |
 | Logs | `journalctl --unit=* -n *` | Query systemd journal for managed services |
 | Logs | `cat /var/log/nginx/*` | Read nginx access and error logs |
 
@@ -77,7 +84,7 @@ Every proxied domain configured in Vacuum Wall enforces:
   - `X-XSS-Protection: 1; mode=block` — Enables browser XSS filtering.
   - `Referrer-Policy: strict-origin-when-cross-origin` — Limits referrer information leakage.
 
-Additional proxy headers (`extra_headers` in the domain config) are delivered to the upstream backend via nginx `proxy_set_header` directives — they are not sent as response headers to clients.
+Additional proxy headers (`headers` in the path-level config) are delivered to the upstream backend via nginx `proxy_set_header` directives — they are not sent as response headers to clients.
 
 ### TLS Configuration