refactor: daemon collectors, thin webui proxies, pure config reads

- move state collectors from lib/state.py to daemon/collectors/ (7
  modules, registration side-effect; daemon/server.py imports the
  package before the first populate())
- webui/api: new daemon_route() decorator factory in common.py
  collapses the try/except daemon-proxy boilerplate in all 8
  blueprints (rules/params/body/transform keep responses identical)
- firewall: interface-coverage invariant — config is the source of
  truth for zone interfaces (absent key = empty, no hands-off
  zones); pure validate_coverage() enforced at save (400) and apply
  (409, force: true overrides), top-level `unmanaged` exemption
- lib: get_config() reads are now pure (no dir creation or writes);
  new lib/bootstrap.py creates runtime dirs and persists the
  one-shot nginx legacy migration at daemon start, after
  system_import (lib.nginx.migrate_config_file)
- lib/common: compute_pending() apply-bookkeeping helper
- daemon: emit_and_refresh() handler helper; refresh_state(bump=) so
  /status/refresh no longer bumps versions (poll/mutation only)
- acme: move --log last so acme.sh never treats a real arg as the
  log-file argument
- docs: AGENTS.md, config.md, state-model.md, api.md updated;
  HARDEN.md dropped (plan implemented); apply-confirm force wording

Tests: 917 passed; ruff check + format clean.

lib/nginx.py

@@ -169,31 +169,45 @@ def _migrate_mgmt_domains(raw: dict[str, Any]) -> None:
 
 
 def get_config() -> dict[str, Any]:
-    """Load the current nginx config, initializing with defaults if needed.
+    """Load the current nginx config (pure read, in-memory migration).
 
-    Ensures config and sites directories exist, applies migrations for
-    legacy formats, then returns the config dict.
+    Never writes or creates directories. Returns the in-memory default when
+    the file is missing and applies legacy-format migration in memory, so
+    read paths (state collectors, apply-time checks) stay side-effect free.
+    The one-shot on-disk migration runs at daemon startup via
+    ``migrate_config_file``.
 
     Returns:
         The complete config dict with ``backends``, ``domains``, and ``ssl`` keys.
     """
-    ensure_dirs(CONFIG_DIR, SITES_DIR)
     raw = load_json(CONFIG_FILE)
     if not raw:
         raw = deepcopy(DEFAULT_CONFIG)
-        save_config(raw)
-        return raw
     if "ssl" not in raw:
         raw["ssl"] = deepcopy(DEFAULT_SSL)
     if "backends" not in raw:
         raw["backends"] = {}
+    return _migrate_config(raw)
+
+
+def migrate_config_file() -> bool:
+    """Persist the one-shot legacy-format migration, if the file needs it.
+
+    Runs at daemon startup so ``get_config`` reads stay pure. Rewrites the
+    on-disk file only when migration actually changes it.
+
+    Returns:
+        True when the on-disk file was rewritten, False otherwise.
+    """
+    raw = load_json(CONFIG_FILE)
+    if not raw:
+        return False
     pre = deepcopy(raw)
     raw = _migrate_config(raw)
-    # Read-only unless normalization/migration actually changed the config;
-    # re-saving on every read rewrites the file (owner/mtime churn).
     if raw != pre:
         save_config(raw)
-    return raw
+        return True
+    return False
 
 
 def save_config(cfg: dict[str, Any]) -> None:
@@ -616,6 +630,7 @@ __all__ = [
     "get_config",
     "get_domains",
     "get_management_domains",
+    "migrate_config_file",
     "remove_domain",
     "save_config",
     "test_config",