refactor: daemon collectors, thin webui proxies, pure config reads

- move state collectors from lib/state.py to daemon/collectors/ (7
  modules, registration side-effect; daemon/server.py imports the
  package before the first populate())
- webui/api: new daemon_route() decorator factory in common.py
  collapses the try/except daemon-proxy boilerplate in all 8
  blueprints (rules/params/body/transform keep responses identical)
- firewall: interface-coverage invariant — config is the source of
  truth for zone interfaces (absent key = empty, no hands-off
  zones); pure validate_coverage() enforced at save (400) and apply
  (409, force: true overrides), top-level `unmanaged` exemption
- lib: get_config() reads are now pure (no dir creation or writes);
  new lib/bootstrap.py creates runtime dirs and persists the
  one-shot nginx legacy migration at daemon start, after
  system_import (lib.nginx.migrate_config_file)
- lib/common: compute_pending() apply-bookkeeping helper
- daemon: emit_and_refresh() handler helper; refresh_state(bump=) so
  /status/refresh no longer bumps versions (poll/mutation only)
- acme: move --log last so acme.sh never treats a real arg as the
  log-file argument
- docs: AGENTS.md, config.md, state-model.md, api.md updated;
  HARDEN.md dropped (plan implemented); apply-confirm force wording

Tests: 917 passed; ruff check + format clean.

daemon/server.py

@@ -18,6 +18,7 @@ from typing import Any
 
 from aiohttp import web
 
+import daemon.collectors  # noqa: F401  (registers state collectors)
 from daemon.iface import PathLike
 from lib.auth import blacklist_expired
 from lib.state import _DEFAULT_POLL_INTERVALS
@@ -145,16 +146,20 @@ class Registry:
 registry = Registry()
 
 
-def refresh_state(subsystems: list[str] | None = None) -> None:
+def refresh_state(subsystems: list[str] | None = None, bump: bool = True) -> None:
     """Refresh the pre-computed state for the given subsystems (or all).
 
     Args:
         subsystems: List of subsystem names to refresh. If None, all subsystems are refreshed.
+        bump: Bump the version counter for each refreshed subsystem.
+            ``refresh_status`` passes ``False`` — versions advance on
+            structural poll diffs and on mutation-triggered refreshes only.
     """
     state_store.populate(subsystems)
     targets = subsystems or state_store.SUBSYSTEMS
-    for name in targets:
-        state_store.bump(name)
+    if bump:
+        for name in targets:
+            state_store.bump(name)
     try:
         asyncio.get_running_loop()
     except RuntimeError:
@@ -600,22 +605,11 @@ async def refresh_status(_request: web.Request) -> web.Response:
     except (json.JSONDecodeError, ValueError):
         body = None
     subsystems = body.get("subsystems") if body else None
-    state_store.populate(subsystems)
-    targets = subsystems or state_store.SUBSYSTEMS
-    snapshot = {name: state_store.get(name) for name in targets}
-
-    # Broadcast to all WS clients (fire-and-forget, gather for parallelism).
     # Deliberately no version bump — versions advance on structural poll
     # diffs and on refresh_state() only.
-    async def _broadcast_all():
-        await asyncio.gather(
-            *[broadcast_versions(name) for name in targets],
-            return_exceptions=True,
-        )
-
-    task = asyncio.create_task(_broadcast_all())
-    task.add_done_callback(_ws_tasks.discard)
-    _ws_tasks.add(task)
+    refresh_state(subsystems, bump=False)
+    targets = subsystems or state_store.SUBSYSTEMS
+    snapshot = {name: state_store.get(name) for name in targets}
     return ok(snapshot)
 
 
@@ -747,6 +741,13 @@ def main() -> None:
     if reconciled:
         logger.info("Reconciled subsystems: %s", ", ".join(reconciled))
 
+    # Filesystem bootstrap after the import (which must see absent config
+    # files to adopt live system state on first start): create runtime
+    # directories and persist the one-shot nginx legacy-format migration.
+    from lib.bootstrap import bootstrap
+
+    bootstrap()
+
     # Reopen group access on the ACME home before the first acme.sh
     # collection: a tree left owner-only by a prior run (e.g. a manual
     # run as the WebUI user) would otherwise fail every daemon acme.sh