refactor: daemon collectors, thin webui proxies, pure config reads

- move state collectors from lib/state.py to daemon/collectors/ (7
  modules, registration side-effect; daemon/server.py imports the
  package before the first populate())
- webui/api: new daemon_route() decorator factory in common.py
  collapses the try/except daemon-proxy boilerplate in all 8
  blueprints (rules/params/body/transform keep responses identical)
- firewall: interface-coverage invariant — config is the source of
  truth for zone interfaces (absent key = empty, no hands-off
  zones); pure validate_coverage() enforced at save (400) and apply
  (409, force: true overrides), top-level `unmanaged` exemption
- lib: get_config() reads are now pure (no dir creation or writes);
  new lib/bootstrap.py creates runtime dirs and persists the
  one-shot nginx legacy migration at daemon start, after
  system_import (lib.nginx.migrate_config_file)
- lib/common: compute_pending() apply-bookkeeping helper
- daemon: emit_and_refresh() handler helper; refresh_state(bump=) so
  /status/refresh no longer bumps versions (poll/mutation only)
- acme: move --log last so acme.sh never treats a real arg as the
  log-file argument
- docs: AGENTS.md, config.md, state-model.md, api.md updated;
  HARDEN.md dropped (plan implemented); apply-confirm force wording

Tests: 917 passed; ruff check + format clean.

tests/test_network_integration.py

@@ -279,18 +279,18 @@ class TestStateParserDedup:
     """Verify lib/state.py uses lib.network.parse_networkctl_status()."""
 
     def test_state_uses_network_parser(self):
-        """The networkd collector in state.py should import from lib.network."""
-        import lib.state as _state
+        """The networkd collector should import from lib.network."""
+        import daemon.collectors.networkd as _collector
 
-        source = Path(_state.__file__).read_text()
-        assert "from lib.network import parse_networkctl_status" in source
+        source = Path(_collector.__file__).read_text()
+        assert "from lib.network import" in source
         assert "parse_networkctl_status" in source
 
     def test_networkd_collector_returns_correct_format(self):
         """_collect_networkd should return interfaces dict + timestamp."""
-        import lib.state as _state
+        import daemon.collectors.networkd as _collector
 
-        with patch("lib.state.run") as mock_run:
+        with patch("daemon.collectors.networkd.run") as mock_run:
             mock_run.return_value = json.dumps(
                 {
                     "Interfaces": [
@@ -320,7 +320,7 @@ class TestStateParserDedup:
                     ]
                 }
             )
-            result = _state._collect_networkd()
+            result = _collector._collect_networkd()
 
             assert "interfaces" in result
             assert "timestamp" in result
@@ -329,10 +329,12 @@ class TestStateParserDedup:
 
     def test_networkd_collector_handles_failure(self):
         """_collect_networkd returns empty interfaces on error."""
-        import lib.state as _state
+        import daemon.collectors.networkd as _collector
 
-        with patch("lib.state.run", side_effect=RuntimeError("no networkctl")):
-            result = _state._collect_networkd()
+        with patch(
+            "daemon.collectors.networkd.run", side_effect=RuntimeError("no networkctl")
+        ):
+            result = _collector._collect_networkd()
 
             assert result["interfaces"] == {}
             assert "timestamp" in result