fix: critical bugs + security hardening

Phase 1 (critical bugs):
- Fix firewall import string-to-list bug (system_import.py)
- Add rich rules removal in firewall config apply (handlers/firewall.py)

Phase 2 (security hardening):
- Restrict sudo wildcards to specific paths (sudoers.d/vacuum-walld)
- Fix TOCTOU: use /run/vacuum-wall/ for temp files (nginx, dnsmasq, network handlers)
- Remove unnecessary sudo from wg genkey/pubkey (handlers/wireguard.py)

Phase 3 (validation):
- Validate poll intervals > 0 (daemon/server.py)
- Restrict sysctl to whitelisted parameters (handlers/network.py)

Phase 4 (defensive programming):
- Enforce shell=False in run() and run_proc() (lib/common.py)
- Track issuance tasks for graceful shutdown (handlers/acme.py)
- Add nginx template marker consistency tests (tests/test_system_import.py)

daemon/handlers/acme.py

@@ -55,7 +55,9 @@ _WEBROOT = PROJECT_DIR / "data" / "acme" / "www"
 
 # In-memory store for active issuance requests.
 _ISSUANCES: dict[str, "IssueRequest"] = {}
+
 _ISSUANCE_TTL = 300  # seconds to keep completed requests
+_ISSUANCE_TASKS: dict[str, asyncio.Task] = {}
 
 
 def _find_issuance(domain: str) -> "IssueRequest | None":
@@ -783,7 +785,8 @@ async def issue_cert(_request: Any, body: dict[str, Any] | None) -> dict[str, An
     _ISSUANCES[request_id] = req
 
     # Spawn background task
-    _task = asyncio.create_task(_run_issue(req))  # noqa: RUF006 — task runs to completion on its own
+    _task = asyncio.create_task(_run_issue(req))
+    _ISSUANCE_TASKS[request_id] = _task
 
     return {"request_id": request_id, "domain": domain}
 
@@ -853,6 +856,8 @@ async def _run_issue(req: IssueRequest) -> None:
         req.status = "failed"
         req.expires_at = datetime.now(UTC).timestamp() + _ISSUANCE_TTL
         logger.error("Cert issuance for %s failed: %s", req.domain, exc)
+    finally:
+        _ISSUANCE_TASKS.pop(req.request_id, None)
 
 
 @registry.register(POST_ACME_RENEW)