fix: critical bugs + security hardening

Phase 1 (critical bugs):
- Fix firewall import string-to-list bug (system_import.py)
- Add rich rules removal in firewall config apply (handlers/firewall.py)

Phase 2 (security hardening):
- Restrict sudo wildcards to specific paths (sudoers.d/vacuum-walld)
- Fix TOCTOU: use /run/vacuum-wall/ for temp files (nginx, dnsmasq, network handlers)
- Remove unnecessary sudo from wg genkey/pubkey (handlers/wireguard.py)

Phase 3 (validation):
- Validate poll intervals > 0 (daemon/server.py)
- Restrict sysctl to whitelisted parameters (handlers/network.py)

Phase 4 (defensive programming):
- Enforce shell=False in run() and run_proc() (lib/common.py)
- Track issuance tasks for graceful shutdown (handlers/acme.py)
- Add nginx template marker consistency tests (tests/test_system_import.py)

daemon/handlers/firewall.py

@@ -219,6 +219,22 @@ def _config_apply() -> dict[str, Any]:
                 sudo=True,
             )
 
+        current_rules = _parse_zone_output(
+            zone_name,
+            run(["firewall-cmd", f"--zone={zone_name}", "--list-all"], sudo=True),
+        ).get("rich-rules", [])
+        for rule_str in current_rules:
+            run(
+                [
+                    "firewall-cmd",
+                    f"--zone={zone_name}",
+                    f"--remove-rich-rule={rule_str}",
+                    "--permanent",
+                ],
+                sudo=True,
+                check=False,
+            )
+
         for rule_entry in zone_cfg.get("rich_rules", []):
             rule_str = (
                 rule_entry.get("rule", "")