refactor: daemon collectors, thin webui proxies, pure config reads

- move state collectors from lib/state.py to daemon/collectors/ (7
  modules, registration side-effect; daemon/server.py imports the
  package before the first populate())
- webui/api: new daemon_route() decorator factory in common.py
  collapses the try/except daemon-proxy boilerplate in all 8
  blueprints (rules/params/body/transform keep responses identical)
- firewall: interface-coverage invariant — config is the source of
  truth for zone interfaces (absent key = empty, no hands-off
  zones); pure validate_coverage() enforced at save (400) and apply
  (409, force: true overrides), top-level `unmanaged` exemption
- lib: get_config() reads are now pure (no dir creation or writes);
  new lib/bootstrap.py creates runtime dirs and persists the
  one-shot nginx legacy migration at daemon start, after
  system_import (lib.nginx.migrate_config_file)
- lib/common: compute_pending() apply-bookkeeping helper
- daemon: emit_and_refresh() handler helper; refresh_state(bump=) so
  /status/refresh no longer bumps versions (poll/mutation only)
- acme: move --log last so acme.sh never treats a real arg as the
  log-file argument
- docs: AGENTS.md, config.md, state-model.md, api.md updated;
  HARDEN.md dropped (plan implemented); apply-confirm force wording

Tests: 917 passed; ruff check + format clean.

tests/test_nginx.py

@@ -70,14 +70,28 @@ class TestGetConfig:
         # No churn: reading a current-format config leaves the file alone.
         assert nginx.CONFIG_FILE.stat().st_mtime_ns == mtime_before
 
-    def test_read_saves_when_migration_applied(self, temp_data_dir):
-        """get_config() persists the file when migration actually changes it."""
+    def test_read_migrates_in_memory_without_writing(self, temp_data_dir):
+        """get_config() is pure: migration is applied in memory, file untouched."""
         nginx.save_config({"domains": {"app.example.com": {"backend": "myapp"}}})
         mtime_before = nginx.CONFIG_FILE.stat().st_mtime_ns
         cfg = nginx.get_config()
-        # Migration added the builtin webui backend.
+        # Migration added the builtin webui backend (in memory only).
         assert cfg["backends"]["webui"]["_migrated"] is True
+        assert nginx.CONFIG_FILE.stat().st_mtime_ns == mtime_before
+
+    def test_migrate_config_file_persists_legacy(self, temp_data_dir):
+        """migrate_config_file() rewrites the file when migration changes it."""
+        nginx.save_config({"domains": {"app.example.com": {"backend": "myapp"}}})
+        mtime_before = nginx.CONFIG_FILE.stat().st_mtime_ns
+        assert nginx.migrate_config_file() is True
         assert nginx.CONFIG_FILE.stat().st_mtime_ns != mtime_before
+        # Idempotent: a second run is a no-op.
+        assert nginx.migrate_config_file() is False
+
+    def test_migrate_config_file_noop_when_missing(self, temp_data_dir):
+        assert not nginx.CONFIG_FILE.exists()
+        assert nginx.migrate_config_file() is False
+        assert not nginx.CONFIG_FILE.exists()
 
 
 class TestSaveConfig: