refactor: daemon collectors, thin webui proxies, pure config reads

- move state collectors from lib/state.py to daemon/collectors/ (7
  modules, registration side-effect; daemon/server.py imports the
  package before the first populate())
- webui/api: new daemon_route() decorator factory in common.py
  collapses the try/except daemon-proxy boilerplate in all 8
  blueprints (rules/params/body/transform keep responses identical)
- firewall: interface-coverage invariant — config is the source of
  truth for zone interfaces (absent key = empty, no hands-off
  zones); pure validate_coverage() enforced at save (400) and apply
  (409, force: true overrides), top-level `unmanaged` exemption
- lib: get_config() reads are now pure (no dir creation or writes);
  new lib/bootstrap.py creates runtime dirs and persists the
  one-shot nginx legacy migration at daemon start, after
  system_import (lib.nginx.migrate_config_file)
- lib/common: compute_pending() apply-bookkeeping helper
- daemon: emit_and_refresh() handler helper; refresh_state(bump=) so
  /status/refresh no longer bumps versions (poll/mutation only)
- acme: move --log last so acme.sh never treats a real arg as the
  log-file argument
- docs: AGENTS.md, config.md, state-model.md, api.md updated;
  HARDEN.md dropped (plan implemented); apply-confirm force wording

Tests: 917 passed; ruff check + format clean.

daemon/handlers/acme.py

@@ -592,7 +592,7 @@ def _check_acme_account() -> tuple[bool, str]:
     except (FileNotFoundError, subprocess.TimeoutExpired):
         pass
 
-    from lib.state import _parse_account_conf
+    from daemon.collectors.acme import _parse_account_conf
 
     info = _parse_account_conf(_ACME_HOME)
     if info.get("registered"):
@@ -607,11 +607,11 @@ def _check_acme_account() -> tuple[bool, str]:
 def _check_account_registered() -> tuple[bool, str]:
     """Blocking check: verify an ACME account is registered.
 
-    Delegates to ``lib.state._parse_account_conf()`` which checks both
+    Delegates to ``daemon.collectors.acme._parse_account_conf()`` which checks both
     the legacy .account.conf and the declarative config/acme/config.json
     used by modern acme.sh (v3.x).
     """
-    from lib.state import _parse_account_conf
+    from daemon.collectors.acme import _parse_account_conf
 
     info = _parse_account_conf(_ACME_HOME)
     if info.get("registered"):
@@ -622,10 +622,10 @@ def _check_account_registered() -> tuple[bool, str]:
 def _get_account_info() -> dict[str, Any]:
     """Read and return the ACME account info dict.
 
-    Delegates to ``lib.state._parse_account_conf()`` for a single
+    Delegates to ``daemon.collectors.acme._parse_account_conf()`` for a single
     source of truth.
     """
-    from lib.state import _parse_account_conf
+    from daemon.collectors.acme import _parse_account_conf
 
     return _parse_account_conf(_ACME_HOME)