feat: pre-computed state store and async ACME issuance (fixes timeout mismatch)

- Add lib/state.py: in-memory state store with subsystem collectors
  (firewall, dnsmasq, nginx, acme, wireguard)
- Refactor all handlers: read from state on GET, call refresh_state()
  after mutations instead of invoking subprocesses per request
- daemon/server.py: add refresh_state(), /status/all, /status/refresh;
  populate state at startup
- webui/api/certs.py: async step-by-step ACME issuance (validate,
  issue with request_id, poll status) replacing blocking endpoint
- webui/server.py: render pages from state instead of direct lib calls
- Update templates, JS for async cert issuance with polling UI
- Update tests for state-based mocking; add test_state.py
- Fix SIM105 lint issue (contextlib.suppress)
- Add TODO.md with certificate issuance issue tracking

Resolves: WebUI 30s timeout freeze during cert issuance (Problem 1)

webui/api/certs.py

@@ -35,24 +35,60 @@ def cert_details(domain: str):
         return _error(str(exc), 500)
 
 
-@bp.route("/issue", methods=["POST"])
-def issue_bp():
+@bp.route("/validate", methods=["POST"])
+def validate():
+    body = request.get_json(silent=True) or {}
+    domain = body.get("domain", "").strip()
+    if not domain:
+        return _error("'domain' is required", 400)
+    try:
+        result = post("/acme/validate", {"domain": domain})
+        return _ok(result)
+    except BadRequest as exc:
+        logger.info("Validation rejected: %s", exc)
+        return _error(str(exc), 400)
+    except RuntimeError as exc:
+        logger.error("Failed to validate cert for '%s': %s", domain, exc)
+        return _error(str(exc), 500)
+
+
+@bp.route("/issue/start", methods=["POST"])
+def issue_start():
     body = request.get_json(silent=True) or {}
     domain = body.get("domain", "").strip()
     if not domain:
         return _error("'domain' is required", 400)
-    webroot = body.get("webroot")
     email = body.get("email", "").strip() or None
+    webroot = body.get("webroot")
     try:
         logger.info("Certificate issuance requested for '%s' via API", domain)
-        post("/acme/issue", {"domain": domain, "webroot": webroot, "email": email})
-        logger.info("Certificate issued for '%s'", domain)
-        return _ok(None)
+        result = post(
+            "/acme/issue", {"domain": domain, "webroot": webroot, "email": email}
+        )
+        logger.info(
+            "Certificate issuance started for '%s' (id=%s)",
+            domain,
+            result.get("request_id"),
+        )
+        return _ok(result)
     except BadRequest as exc:
         logger.info("Cert issue for '%s' rejected: %s", domain, exc)
         return _error(str(exc), 400)
     except RuntimeError as exc:
-        logger.error("Failed to issue cert for '%s': %s", domain, exc)
+        logger.error("Failed to start cert issue for '%s': %s", domain, exc)
+        return _error(str(exc), 500)
+
+
+@bp.route("/issue/<request_id>", methods=["GET"])
+def issue_status(request_id: str):
+    try:
+        result = get("/acme/issue/status", {"id": request_id})
+        return _ok(result)
+    except NotFound as exc:
+        logger.info("Issuance request '%s' not found: %s", request_id, exc)
+        return _error(str(exc), 404)
+    except RuntimeError as exc:
+        logger.error("Failed to get issuance status for '%s': %s", request_id, exc)
         return _error(str(exc), 500)