refactor: daemon collectors, thin webui proxies, pure config reads

- move state collectors from lib/state.py to daemon/collectors/ (7
  modules, registration side-effect; daemon/server.py imports the
  package before the first populate())
- webui/api: new daemon_route() decorator factory in common.py
  collapses the try/except daemon-proxy boilerplate in all 8
  blueprints (rules/params/body/transform keep responses identical)
- firewall: interface-coverage invariant — config is the source of
  truth for zone interfaces (absent key = empty, no hands-off
  zones); pure validate_coverage() enforced at save (400) and apply
  (409, force: true overrides), top-level `unmanaged` exemption
- lib: get_config() reads are now pure (no dir creation or writes);
  new lib/bootstrap.py creates runtime dirs and persists the
  one-shot nginx legacy migration at daemon start, after
  system_import (lib.nginx.migrate_config_file)
- lib/common: compute_pending() apply-bookkeeping helper
- daemon: emit_and_refresh() handler helper; refresh_state(bump=) so
  /status/refresh no longer bumps versions (poll/mutation only)
- acme: move --log last so acme.sh never treats a real arg as the
  log-file argument
- docs: AGENTS.md, config.md, state-model.md, api.md updated;
  HARDEN.md dropped (plan implemented); apply-confirm force wording

Tests: 917 passed; ruff check + format clean.

lib/common.py

@@ -120,6 +120,24 @@ def _diff_nodes(old: Any, new: Any, path: str, out: list[dict[str, Any]]) -> Non
         out.append({"path": path, "action": "changed", "old": old, "new": new})
 
 
+def compute_pending(cfg: dict[str, Any]) -> tuple[bool, list[dict[str, Any]]]:
+    """Return ``(pending_changes, pending_diff)`` from apply bookkeeping keys.
+
+    ``pending_changes`` is ``True`` when the config was never applied or its
+    content no longer matches the recorded ``_last_applied_hash``. When
+    pending and a ``_last_applied_config`` snapshot is recorded, the diff is a
+    field-level comparison of the snapshot against the current (meta-stripped)
+    config; otherwise it is empty.
+    """
+    pending = _APPLY_HASH_KEY not in cfg or cfg[_APPLY_HASH_KEY] != config_hash(cfg)
+    diff: list[dict[str, Any]] = []
+    if pending:
+        snap = cfg.get(_LAST_APPLIED_CONFIG_KEY)
+        if isinstance(snap, dict):
+            diff = deep_diff(snap, strip_apply_meta(cfg))
+    return pending, diff
+
+
 def validate_interface_name(name: str) -> str:
     """Validate a Linux network interface name.
 
@@ -301,6 +319,7 @@ __all__ = [
     "_APPLY_HASH_KEY",
     "_LAST_APPLIED_CONFIG_KEY",
     "_hash_password",
+    "compute_pending",
     "config_hash",
     "deep_diff",
     "deep_merge",