refactor: daemon collectors, thin webui proxies, pure config reads

- move state collectors from lib/state.py to daemon/collectors/ (7
  modules, registration side-effect; daemon/server.py imports the
  package before the first populate())
- webui/api: new daemon_route() decorator factory in common.py
  collapses the try/except daemon-proxy boilerplate in all 8
  blueprints (rules/params/body/transform keep responses identical)
- firewall: interface-coverage invariant — config is the source of
  truth for zone interfaces (absent key = empty, no hands-off
  zones); pure validate_coverage() enforced at save (400) and apply
  (409, force: true overrides), top-level `unmanaged` exemption
- lib: get_config() reads are now pure (no dir creation or writes);
  new lib/bootstrap.py creates runtime dirs and persists the
  one-shot nginx legacy migration at daemon start, after
  system_import (lib.nginx.migrate_config_file)
- lib/common: compute_pending() apply-bookkeeping helper
- daemon: emit_and_refresh() handler helper; refresh_state(bump=) so
  /status/refresh no longer bumps versions (poll/mutation only)
- acme: move --log last so acme.sh never treats a real arg as the
  log-file argument
- docs: AGENTS.md, config.md, state-model.md, api.md updated;
  HARDEN.md dropped (plan implemented); apply-confirm force wording

Tests: 917 passed; ruff check + format clean.

webui/api/status.py

@@ -3,13 +3,12 @@
 Exposed at /api/status/* and delegates all operations to vacuum-walld.
 """
 
-from __future__ import annotations
+from flask import Blueprint
 
-import logging
-
-from flask import Blueprint, request
-
-from daemon.client import get, post
+from daemon.client import (  # noqa: F401 (resolved via module globals at dispatch)
+    get,
+    post,
+)
 from daemon.iface import (
     GET_STATUS_PENDING,
     GET_SYSTEM_METRICS,
@@ -17,97 +16,31 @@ from daemon.iface import (
     POST_STATUS_CANCEL_ALL,
     POST_STATUS_REFRESH,
 )
-from webui.api.common import _error, _ok
+from webui.api.common import NO_BODY, daemon_route
 
-logger = logging.getLogger(__name__)
 bp = Blueprint("status", __name__)
 
 
-@bp.route("/pending", methods=["GET"])
+@daemon_route(GET_STATUS_PENDING, bp)
 def pending():
-    """Retrieve aggregate pending changes across all subsystems.
-
-    Endpoint:
-        GET /api/status/pending
-
-    Returns:
-        JSON response with per-subsystem pending status and total change count.
-    """
-    try:
-        return _ok(get(GET_STATUS_PENDING))
-    except RuntimeError as exc:
-        logger.error("Failed to get pending status: %s", exc)
-        return _error(str(exc), 500)
+    """GET /api/status/pending — Per-subsystem pending status + total change count."""
 
 
-@bp.route("/apply-all", methods=["POST"])
+@daemon_route(POST_STATUS_APPLY_ALL, bp)
 def apply_all():
-    """Apply pending changes for all subsystems in dependency order.
-
-    Endpoint:
-        POST /api/status/apply-all
-    Body:
-        {"force": true} (optional) — overrides the firewall safety guards
-        (management lockout, interface coverage) for this apply.
-
-    Returns:
-        JSON response with applied subsystems list and any errors encountered.
-    """
-    body = request.get_json(silent=True)
-    try:
-        return _ok(post(POST_STATUS_APPLY_ALL, body))
-    except RuntimeError as exc:
-        logger.error("Failed to apply all pending changes: %s", exc)
-        return _error(str(exc), 500)
+    """POST /api/status/apply-all — Apply pending changes in dependency order."""
 
 
-@bp.route("/cancel-all", methods=["POST"])
+@daemon_route(POST_STATUS_CANCEL_ALL, bp, body=NO_BODY)
 def cancel_all():
-    """Revert pending changes for all subsystems to the last applied config.
-
-    Endpoint:
-        POST /api/status/cancel-all
-
-    Returns:
-        JSON response with the reverted subsystems, skipped subsystems
-        (label -> reason), and any errors encountered.
-    """
-    try:
-        return _ok(post(POST_STATUS_CANCEL_ALL))
-    except RuntimeError as exc:
-        logger.error("Failed to cancel all pending changes: %s", exc)
-        return _error(str(exc), 500)
+    """POST /api/status/cancel-all — Revert pending changes to last applied config."""
 
 
-@bp.route("/refresh", methods=["POST"])
+@daemon_route(POST_STATUS_REFRESH, bp)
 def refresh():
-    """Re-collect state from the daemon, optionally filtered by subsystem.
-
-    Endpoint:
-        POST /api/status/refresh
-    Body:
-        {"subsystems": ["firewall"]} or {} for all.
-    """
-    body = request.get_json(silent=True) or {}
-    try:
-        return _ok(post(POST_STATUS_REFRESH, body))
-    except RuntimeError as exc:
-        logger.error("Failed to refresh state: %s", exc)
-        return _error(str(exc), 500)
+    """POST /api/status/refresh — Re-collect state, optionally filtered by subsystem."""
 
 
-@bp.route("/system-metrics", methods=["GET"])
+@daemon_route(GET_SYSTEM_METRICS, bp, rule="/system-metrics")
 def system_metrics():
-    """Retrieve system-wide metrics.
-
-    Endpoint:
-        GET /api/status/system-metrics
-
-    Returns:
-        JSON response with CPU load, memory usage, and network traffic stats.
-    """
-    try:
-        return _ok(get(GET_SYSTEM_METRICS))
-    except RuntimeError as exc:
-        logger.error("Failed to get system metrics: %s", exc)
-        return _error(str(exc), 500)
+    """GET /api/status/system-metrics — System-wide CPU/memory/network metrics."""