refactor: daemon collectors, thin webui proxies, pure config reads

- move state collectors from lib/state.py to daemon/collectors/ (7
  modules, registration side-effect; daemon/server.py imports the
  package before the first populate())
- webui/api: new daemon_route() decorator factory in common.py
  collapses the try/except daemon-proxy boilerplate in all 8
  blueprints (rules/params/body/transform keep responses identical)
- firewall: interface-coverage invariant — config is the source of
  truth for zone interfaces (absent key = empty, no hands-off
  zones); pure validate_coverage() enforced at save (400) and apply
  (409, force: true overrides), top-level `unmanaged` exemption
- lib: get_config() reads are now pure (no dir creation or writes);
  new lib/bootstrap.py creates runtime dirs and persists the
  one-shot nginx legacy migration at daemon start, after
  system_import (lib.nginx.migrate_config_file)
- lib/common: compute_pending() apply-bookkeeping helper
- daemon: emit_and_refresh() handler helper; refresh_state(bump=) so
  /status/refresh no longer bumps versions (poll/mutation only)
- acme: move --log last so acme.sh never treats a real arg as the
  log-file argument
- docs: AGENTS.md, config.md, state-model.md, api.md updated;
  HARDEN.md dropped (plan implemented); apply-confirm force wording

Tests: 917 passed; ruff check + format clean.

webui/api/logs.py

@@ -3,11 +3,9 @@
 Wraps raw log text in the standard JSON response contract.
 """
 
-import logging
-
 from flask import Blueprint
 
-from daemon.client import NotFound, get
+from daemon.client import get  # noqa: F401 (resolved via module globals at dispatch)
 from daemon.iface import (
     GET_LOGS_APP,
     GET_LOGS_DNSMASQ,
@@ -15,58 +13,31 @@ from daemon.iface import (
     GET_LOGS_NGINX_ACCESS,
     GET_LOGS_NGINX_ERROR,
 )
-from webui.api.common import _error, _ok
+from webui.api.common import daemon_route
 
-logger = logging.getLogger(__name__)
 bp = Blueprint("logs", __name__)
 
 
-@bp.route("/journal")
+@daemon_route(GET_LOGS_JOURNAL, bp)
 def journal():
     """GET /api/logs/journal — Return systemd journal log lines."""
-    try:
-        return _ok(get(GET_LOGS_JOURNAL))
-    except RuntimeError:
-        return _error("error reading journal", 500)
 
 
-@bp.route("/nginx/access")
+@daemon_route(GET_LOGS_NGINX_ACCESS, bp)
 def nginx_access():
     """GET /api/logs/nginx/access — Return nginx access log lines."""
-    try:
-        return _ok(get(GET_LOGS_NGINX_ACCESS))
-    except NotFound:
-        return _error("log file not found", 404)
-    except RuntimeError:
-        return _error("error reading log", 500)
 
 
-@bp.route("/nginx/error")
+@daemon_route(GET_LOGS_NGINX_ERROR, bp)
 def nginx_error():
     """GET /api/logs/nginx/error — Return nginx error log lines."""
-    try:
-        return _ok(get(GET_LOGS_NGINX_ERROR))
-    except NotFound:
-        return _error("log file not found", 404)
-    except RuntimeError:
-        return _error("error reading log", 500)
 
 
-@bp.route("/dnsmasq")
+@daemon_route(GET_LOGS_DNSMASQ, bp)
 def dnsmasq():
     """GET /api/logs/dnsmasq — Return dnsmasq log lines."""
-    try:
-        return _ok(get(GET_LOGS_DNSMASQ))
-    except RuntimeError:
-        return _error("error reading journal", 500)
 
 
-@bp.route("/app")
+@daemon_route(GET_LOGS_APP, bp)
 def app_log():
     """GET /api/logs/app — Return application log lines."""
-    try:
-        return _ok(get(GET_LOGS_APP))
-    except NotFound:
-        return _error("log file not found", 404)
-    except RuntimeError:
-        return _error("error reading log", 500)