fix: critical bugs + security hardening

Phase 1 (critical bugs):
- Fix firewall import string-to-list bug (system_import.py)
- Add rich rules removal in firewall config apply (handlers/firewall.py)

Phase 2 (security hardening):
- Restrict sudo wildcards to specific paths (sudoers.d/vacuum-walld)
- Fix TOCTOU: use /run/vacuum-wall/ for temp files (nginx, dnsmasq, network handlers)
- Remove unnecessary sudo from wg genkey/pubkey (handlers/wireguard.py)

Phase 3 (validation):
- Validate poll intervals > 0 (daemon/server.py)
- Restrict sysctl to whitelisted parameters (handlers/network.py)

Phase 4 (defensive programming):
- Enforce shell=False in run() and run_proc() (lib/common.py)
- Track issuance tasks for graceful shutdown (handlers/acme.py)
- Add nginx template marker consistency tests (tests/test_system_import.py)

daemon/handlers/dnsmasq.py

@@ -189,10 +189,10 @@ def apply_config(_request: Any, _body: Any) -> dict[str, Any]:
     conf_text = _generate_conf(cfg)
     ensure_dirs(CONFIG_DIR, DATA_DIR, FRAGMENTS_DIR)
     run(["mkdir", "-p", "/etc/dnsmasq.d"], sudo=True)
-    tmp = Path("/tmp") / "vacuum-wall-dnsmasq.tmp"
-    with open(tmp, "w") as f:
-        f.write(conf_text)
-    run(["cp", str(tmp), DNSMASQ_CONF], sudo=True)
+    tmp = Path("/run/vacuum-wall/dnsmasq.tmp")
+    tmp.parent.mkdir(exist_ok=True)
+    tmp.write_text(conf_text)
+    run(["cp", "--", str(tmp), str(DNSMASQ_CONF)], sudo=True)
     tmp.unlink(missing_ok=True)
     run(["systemctl", "restart", "dnsmasq"], sudo=True)
     logger.info("dnsmasq config written and restarted")