refactor: daemon collectors, thin webui proxies, pure config reads

- move state collectors from lib/state.py to daemon/collectors/ (7
  modules, registration side-effect; daemon/server.py imports the
  package before the first populate())
- webui/api: new daemon_route() decorator factory in common.py
  collapses the try/except daemon-proxy boilerplate in all 8
  blueprints (rules/params/body/transform keep responses identical)
- firewall: interface-coverage invariant — config is the source of
  truth for zone interfaces (absent key = empty, no hands-off
  zones); pure validate_coverage() enforced at save (400) and apply
  (409, force: true overrides), top-level `unmanaged` exemption
- lib: get_config() reads are now pure (no dir creation or writes);
  new lib/bootstrap.py creates runtime dirs and persists the
  one-shot nginx legacy migration at daemon start, after
  system_import (lib.nginx.migrate_config_file)
- lib/common: compute_pending() apply-bookkeeping helper
- daemon: emit_and_refresh() handler helper; refresh_state(bump=) so
  /status/refresh no longer bumps versions (poll/mutation only)
- acme: move --log last so acme.sh never treats a real arg as the
  log-file argument
- docs: AGENTS.md, config.md, state-model.md, api.md updated;
  HARDEN.md dropped (plan implemented); apply-confirm force wording

Tests: 917 passed; ruff check + format clean.

tests/test_wireguard.py

@@ -336,7 +336,7 @@ class TestGenerateWgShowParser:
             "  listening port: 51820\n"
             "  peer: PUBKEY1\n    endpoint: 203.0.113.1:51820\n    allowed ips: 10.0.0.0/24\n"
         )
-        result = wireguard._parse_wg_show_output(output)
+        result = wireguard.parse_wg_show_output(output)
         assert result["up"] is True
         assert result["interface"]["public_key"] == "IFACE-PUB"
         assert result["interface"]["listen_port"] == 51820
@@ -346,10 +346,46 @@ class TestGenerateWgShowParser:
         assert result["peers"][0]["allowed_ips"] == ["10.0.0.0/24"]
 
     def test_empty_output(self):
-        result = wireguard._parse_wg_show_output("")
+        result = wireguard.parse_wg_show_output("")
         assert result["up"] is False
         assert result["peers"] == []
 
+    def test_parses_fwmark(self):
+        output = (
+            "interface: wg0\n"
+            "  public key: IFACE-PUB\n"
+            "  listening port: 51820\n"
+            "  fwmark: 0x0\n"
+        )
+        result = wireguard.parse_wg_show_output(output)
+        assert result["up"] is True
+        assert result["interface"]["fwmark"] == "0x0"
+
+    def test_peer_transfer_and_keepalive(self):
+        output = (
+            "interface: wg0\n"
+            "  public key: IFACE-PUB\n"
+            "  listening port: 51820\n"
+            "  peer: PUBKEY1\n"
+            "    endpoint: 203.0.113.1:51820\n"
+            "    allowed ips: 10.0.0.0/24, 10.0.1.0/24\n"
+            "    latest handshake: 2 minutes ago\n"
+            "    transfer: 1.23 GiB received, 4.56 GiB sent\n"
+            "    persistent-keepalive: 25\n"
+        )
+        result = wireguard.parse_wg_show_output(output)
+        peer = result["peers"][0]
+        assert peer["allowed_ips"] == ["10.0.0.0/24", "10.0.1.0/24"]
+        assert peer["latest_handshake"] == "2 minutes ago"
+        assert peer["transfer_received"] == "1.23 GiB received"
+        assert peer["transfer_sent"] == "4.56 GiB sent"
+        assert peer["persistent_keepalive"] == 25
+
+    def test_bad_keepalive_value(self):
+        output = "interface: wg0\n  peer: PUBKEY1\n    persistent-keepalive: bogus\n"
+        result = wireguard.parse_wg_show_output(output)
+        assert result["peers"][0]["persistent_keepalive"] is None
+
 
 class TestAccessClasses:
     def test_default_config_has_access_classes(self):