refactor: daemon collectors, thin webui proxies, pure config reads

- move state collectors from lib/state.py to daemon/collectors/ (7
  modules, registration side-effect; daemon/server.py imports the
  package before the first populate())
- webui/api: new daemon_route() decorator factory in common.py
  collapses the try/except daemon-proxy boilerplate in all 8
  blueprints (rules/params/body/transform keep responses identical)
- firewall: interface-coverage invariant — config is the source of
  truth for zone interfaces (absent key = empty, no hands-off
  zones); pure validate_coverage() enforced at save (400) and apply
  (409, force: true overrides), top-level `unmanaged` exemption
- lib: get_config() reads are now pure (no dir creation or writes);
  new lib/bootstrap.py creates runtime dirs and persists the
  one-shot nginx legacy migration at daemon start, after
  system_import (lib.nginx.migrate_config_file)
- lib/common: compute_pending() apply-bookkeeping helper
- daemon: emit_and_refresh() handler helper; refresh_state(bump=) so
  /status/refresh no longer bumps versions (poll/mutation only)
- acme: move --log last so acme.sh never treats a real arg as the
  log-file argument
- docs: AGENTS.md, config.md, state-model.md, api.md updated;
  HARDEN.md dropped (plan implemented); apply-confirm force wording

Tests: 917 passed; ruff check + format clean.

lib/wireguard.py

@@ -370,7 +370,7 @@ def status() -> dict[str, Any]:
             if res.returncode != 0:
                 result["classes"][class_key] = {"up": False, "peers": []}
                 continue
-            class_status = _parse_wg_show_output(res.stdout.strip())
+            class_status = parse_wg_show_output(res.stdout.strip())
             result["classes"][class_key] = class_status
             if class_status["up"]:
                 result["up"] = True
@@ -382,7 +382,7 @@ def status() -> dict[str, Any]:
         ifname = cfg["interface"].get("name", "wg0")
         res = run_proc([WG_BIN, "show", ifname], sudo=True, check=False)
         if res.returncode == 0:
-            parsed = _parse_wg_show_output(res.stdout.strip())
+            parsed = parse_wg_show_output(res.stdout.strip())
             result["up"] = parsed["up"]
             result["interface"] = parsed.get("interface", {})
             result["peers"] = parsed.get("peers", [])
@@ -392,8 +392,12 @@ def status() -> dict[str, Any]:
     return result
 
 
-def _parse_wg_show_output(raw: str) -> dict[str, Any]:
-    """Parse ``wg show`` output into structured dict."""
+def parse_wg_show_output(raw: str) -> dict[str, Any]:
+    """Parse ``wg show`` output into structured dict.
+
+    Returns ``{"up", "interface", "peers"}`` where *interface* carries
+    ``public_key``, ``listen_port`` and (when present) ``fwmark``.
+    """
     result: dict[str, Any] = {
         "up": False,
         "interface": {},
@@ -742,6 +746,7 @@ __all__ = [
     "get_peer_status",
     "get_peers",
     "initialize",
+    "parse_wg_show_output",
     "remove_peer",
     "save_config",
     "set_listen_port",