Migrate declarative configs to config/ dir and remove hardcoded paths

Replace all hardcoded /home/wall/vacuum-wall paths in lib/ with Path(__file__).resolve()
auto-discovery. Move config files from data/ to config/<subsystem>/config.json.
ACME now uses ACME_HOME env var and data/acme/ for cert storage. Systemd units
and sudoers use {{ USER_NAME }}, {{ PROJECT_DIR }}, {{ ACME_HOME }} Jinja2
template variables for install-time substitution. Remove sys.path.insert boot
strap from test files.

system/systemd/vacuum-wall-acme.service

@@ -3,6 +3,8 @@ Description=Vacuum Wall ACME Certificate Renewal
 
 [Service]
 Type=oneshot
-User=vacuum-wall
-WorkingDirectory=/home/wall/vacuum-wall
-ExecStart=/usr/local/bin/acme.sh --cron --home /home/vacuum-wall/.acme.sh
+User={{ USER_NAME }}
+WorkingDirectory={{ PROJECT_DIR }}
+Environment=ACME_HOME={{ PROJECT_DIR }}/data/acme
+Environment=HOME={{ PROJECT_DIR }}
+ExecStart=/usr/local/bin/acme.sh --cron --home {{ ACME_HOME }}

system/systemd/vacuum-wall.service

@@ -6,20 +6,21 @@ Wants=firewalld.service
 
 [Service]
 Type=simple
-User=vacuum-wall
-Group=vacuum-wall
-WorkingDirectory=/home/wall/vacuum-wall
-ExecStart=/home/wall/vacuum-wall/.venv/bin/python webui/server.py
+User={{ USER_NAME }}
+Group={{ USER_NAME }}
+WorkingDirectory={{ PROJECT_DIR }}
+ExecStart={{ PROJECT_DIR }}/.venv/bin/python webui/server.py
 Restart=on-failure
 RestartSec=5
 Environment=PATH=/usr/local/bin:/usr/bin
 Environment=PYTHONUNBUFFERED=1
+Environment=ACME_HOME={{ PROJECT_DIR }}/data/acme
+Environment=HOME={{ PROJECT_DIR }}
 
 # Security hardening
 NoNewPrivileges=yes
 ProtectSystem=strict
-ProtectHome=read-only
-ReadWritePaths=/home/wall/vacuum-wall/data /tmp
+ReadWritePaths={{ PROJECT_DIR }}/config {{ PROJECT_DIR }}/data /tmp
 PrivateTmp=yes
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
@@ -33,7 +34,8 @@ LockPersonality=yes
 SystemCallFilter=@system-service
 PrivateDevices=yes
 
-# Network - only loopback (nginx proxies to us)
+ProtectHome=read-only
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 IPAddressDeny=all
 IPAddressAllow=localhost