docs: update documentation and project structure

- Update AGENTS.md, README.md, and docs/* with revisions
- Refactor lib/acme.py and lib/state.py
- Add tests for acme module
- Remove install.sh and restart-services.sh (moved to scripts/)
- Normalize vendor files (acme.sh, htm.js)

docs/deployment.md

@@ -25,13 +25,13 @@ Download the Vacuum Wall repository onto the target machine, then run the instal
 # Production: all env vars
 MGMT_DOMAIN=wall.example.com \
 MGMT_PASS="strongpassword" \
-./install.sh --user vacuum-wall
+./scripts/install.sh --user vacuum-wall
 
 # Dev mode: CLI flags, auto-detects repo owner
-./install.sh --dev --mgmt-pass strongpassword
+./scripts/install.sh --dev --mgmt-pass strongpassword
 
 # mDNS (LAN-only, no DNS record needed)
-./install.sh --mgmt-domain vacuum-wall.local --mgmt-pass strongpass
+./scripts/install.sh --mgmt-domain vacuum-wall.local --mgmt-pass strongpass
 ```
 
 ### Options
@@ -51,7 +51,7 @@ All settings that can be passed as an environment variable also have a CLI flag
 | `--lan-ifaces` | `LAN_IFACES` | No | LAN interface names, comma-separated. Auto-detected from non-loopback, non-WAN interfaces. |
 | `--force-venv` | — | No | Force recreation of the Python virtual environment. |
 
-Run `./install.sh --help` for full usage.
+Run `./scripts/install.sh --help` for full usage.
 
 ---
 
@@ -71,7 +71,7 @@ In dev mode, the ownership model preserves the developer's ability to work with
 ### Running the Installer in Dev Mode
 
 ```bash
-./install.sh --dev --mgmt-pass strongpassword
+./scripts/install.sh --dev --mgmt-pass strongpassword
 ```
 
 The script detects the repo owner (e.g., `wall`), creates the `vacuum-walld` daemon user with the repo owner's primary group, and sets up the ownership model described above.
@@ -88,7 +88,7 @@ You can deploy Vacuum Wall in a container or at any custom path. Use `--path` (o
 
 ```bash
 # Docker volume mount example
-./install.sh --path /app/vacuum-wall --user ww-app \
+./scripts/install.sh --path /app/vacuum-wall --user ww-app \
     --mgmt-domain proxy.internal --mgmt-pass strongpassword
 ```
 
@@ -96,7 +96,7 @@ The systemd service unit files and sudoers whitelist are rendered from Jinja2 te
 
 ---
 
-## What install.sh Does
+## What scripts/install.sh Does
 
 The installer performs the following steps automatically:
 
@@ -130,7 +130,7 @@ The installer performs the following steps automatically:
 
 ### Idempotent Re-Runs
 
-`install.sh` is fully idempotent and safe to run multiple times. Re-running the script:
+`scripts/install.sh` is fully idempotent and safe to run multiple times. Re-running the script:
 
 - Skips the Python venv (use `--force-venv` to rebuild)
 - Restarts `vacuum-walld`, `vacuum-wall`, and reloads `nginx` to pick up changes
@@ -138,7 +138,7 @@ The installer performs the following steps automatically:
 - Preserves existing `config.json` files (skips initial write if file exists)
 - Safely updates `htpasswd` (uses update mode instead of create mode)
 
-This makes it safe for development workflows: simply run `bash install.sh` again to update an existing installation.
+This makes it safe for development workflows: simply run `bash scripts/install.sh` again to update an existing installation.
 
 ---