Just setup my first instance to play around with. I installed on a cPanel dev server and the instructions were very similar to your HestiaCP installation instructions found here: https://docs.itflow.org/installation_hestiacp

Couple things during the setup I noticed:

In your setup instructions you should remind people to check ownership and permissions. Not a big deal but I got a server error until I checked the error logs and noticed that I forgot to adjust permissions. Including this in instructions might help someone out and prevent a ticket on the forum.
in /uploads/.htaccess you have php_flag engine off which causes errors in environments running PHP-FPM or suPHP because they don't allow directives to be set in htaccess (must be set in .user.ini or php.ini). This was first noticed when the logo I uploaded wouldn't show up. In reality, this line is not needed. You already block CGI execution, remove handles and types, and deny to most common executables. I would just add php5, php7, php8, py, asp, and jsp to your filesmatch. Alternately you can AddType text/plain .php .phtml .php5 .php7 .php8 .phar which will force it to display as text and may be useful for viewing code as a text instead of just blocking access completely. Also can stop code disguised as images. Should also add <Files ".htaccess">Require all denied</Files> or FilesMatch "^\." to block all hidden dot file access.

A slightly more secure solution would be to place uploads below root and have a php script serve up the requested uploads, this way you can assign permissions to the files and only allow authenticated users to access sensitive uploads (like things sent between ticket conversations, etc..) but this adds a little overhead, doesn't support your app directory structure, and doesn't easily integrate with your file based routing.

When I first installed and tried to access the /agent/clients.php it would not work at all. After a bit of searching through logs I found that there is a problem with how you're using GROUP BY in your SQL statement. A quick fix was to remove ONLY_FULL_GROUPBY from my SQL config (sql_mode), but this should really be fixed in the SQL statements as most modern databases enable strict modes by default.
Setup completion. In your /config.php you have $config-enable-setup (underscore instead of hyphens - i can't seem to escape underscores here from turning into italics) to $config-setup-complete and then place the line $config-base-url .= empty($config-setup-complete) ? '/setup' : ''; because I had an additional problem where after setup the emails sent in ticket correspondence would make the link to domain.com/setup/guest/guest*…. *and cause the page to 404. Seems that this is set in the web setup to use http host and request uri.. might be better to add a form field to let people confirm their installation directory as well.

The reason I suggest changing the name to config-setup-complete is because later in your code you're checking if !isset() OR if == 1 to indicate completion, so a cleaner way would be to check if empty setup complete - which empty is either unset, null, 0, false, etc..