refactor: daemon collectors, thin webui proxies, pure config reads

- move state collectors from lib/state.py to daemon/collectors/ (7
  modules, registration side-effect; daemon/server.py imports the
  package before the first populate())
- webui/api: new daemon_route() decorator factory in common.py
  collapses the try/except daemon-proxy boilerplate in all 8
  blueprints (rules/params/body/transform keep responses identical)
- firewall: interface-coverage invariant — config is the source of
  truth for zone interfaces (absent key = empty, no hands-off
  zones); pure validate_coverage() enforced at save (400) and apply
  (409, force: true overrides), top-level `unmanaged` exemption
- lib: get_config() reads are now pure (no dir creation or writes);
  new lib/bootstrap.py creates runtime dirs and persists the
  one-shot nginx legacy migration at daemon start, after
  system_import (lib.nginx.migrate_config_file)
- lib/common: compute_pending() apply-bookkeeping helper
- daemon: emit_and_refresh() handler helper; refresh_state(bump=) so
  /status/refresh no longer bumps versions (poll/mutation only)
- acme: move --log last so acme.sh never treats a real arg as the
  log-file argument
- docs: AGENTS.md, config.md, state-model.md, api.md updated;
  HARDEN.md dropped (plan implemented); apply-confirm force wording

Tests: 917 passed; ruff check + format clean.

daemon/handlers/network.py

@@ -10,6 +10,7 @@ import re
 from pathlib import Path
 from typing import Any
 
+from daemon.handlers.common import emit_and_refresh
 from daemon.iface import (
     GET_NETWORK_INFER_DHCP_RANGES,
     GET_NETWORK_INFER_ZONES,
@@ -20,7 +21,7 @@ from daemon.iface import (
     POST_NETWORK_INTERFACE_RELOAD,
     POST_NETWORK_SYSCTL_SET,
 )
-from daemon.server import NotFoundError, refresh_state, registry
+from daemon.server import NotFoundError, registry
 from lib.common import run, stamp_applied, validate_interface_name
 from lib.dnsmasq import get_config as _get_dm_cfg
 from lib.dnsmasq import save_config as _save_dm_cfg
@@ -36,7 +37,6 @@ from lib.network import (
     render_network_file,
     save_config,
 )
-from lib.sync import SyncEvent, bus
 
 logger = logging.getLogger(__name__)
 
@@ -220,16 +220,13 @@ def save_interface(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]
     cfg_after = get_config()
     stamp_applied(cfg_after)
     save_config(cfg_after)
-    sync_result = bus.emit(
-        SyncEvent(
-            "networkd", "config_saved", {"action": "interface_saved", "interface": name}
-        )
+    synced = emit_and_refresh(
+        "networkd", {"action": "interface_saved", "interface": name}
     )
-    refresh_state(["networkd", *sync_result.affected_subsystems])
     return {
         "name": name,
         "applied": deployed,
-        "synced": sync_result.affected_subsystems,
+        "synced": synced,
     }
 
 
@@ -298,10 +295,7 @@ def apply_all(_request: Any, _body: Any) -> dict[str, Any]:
     cfg_after = get_config()
     stamp_applied(cfg_after)
     save_config(cfg_after)
-    sync_result = bus.emit(
-        SyncEvent("networkd", "config_saved", {"action": "config_applied"})
-    )
-    refresh_state(["networkd", *sync_result.affected_subsystems])
+    synced = emit_and_refresh("networkd", {"action": "config_applied"})
 
     logger.info(
         "Network config applied: %d interfaces, %d stale cleaned",
@@ -312,7 +306,7 @@ def apply_all(_request: Any, _body: Any) -> dict[str, Any]:
         "applied": len(generated),
         "files": [str(p) for p in generated],
         "cleaned": [str(p) for p in cleaned],
-        "synced": sync_result.affected_subsystems,
+        "synced": synced,
     }
 
 
@@ -366,8 +360,5 @@ def set_sysctl(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
         )
 
     logger.info("sysctl %s set to %s", name, value)
-    sync_result = bus.emit(
-        SyncEvent("networkd", "config_saved", {"action": "sysctl_set", "name": name})
-    )
-    refresh_state(["networkd", *sync_result.affected_subsystems])
+    emit_and_refresh("networkd", {"action": "sysctl_set", "name": name})
     return {"name": name, "value": value}