fix: critical bugs + security hardening

Phase 1 (critical bugs):
- Fix firewall import string-to-list bug (system_import.py)
- Add rich rules removal in firewall config apply (handlers/firewall.py)

Phase 2 (security hardening):
- Restrict sudo wildcards to specific paths (sudoers.d/vacuum-walld)
- Fix TOCTOU: use /run/vacuum-wall/ for temp files (nginx, dnsmasq, network handlers)
- Remove unnecessary sudo from wg genkey/pubkey (handlers/wireguard.py)

Phase 3 (validation):
- Validate poll intervals > 0 (daemon/server.py)
- Restrict sysctl to whitelisted parameters (handlers/network.py)

Phase 4 (defensive programming):
- Enforce shell=False in run() and run_proc() (lib/common.py)
- Track issuance tasks for graceful shutdown (handlers/acme.py)
- Add nginx template marker consistency tests (tests/test_system_import.py)

daemon/handlers/wireguard.py

@@ -171,11 +171,9 @@ def apply(_request: Any, _body: Any) -> dict[str, Any]:
     cfg = _get_config()
     conf_text = _generate_conf(cfg)
     _save_config(cfg)
-    local_dir = PROJECT_DIR / "data" / "wireguard"
-    local_dir.mkdir(parents=True, exist_ok=True)
-    local_tmp = local_dir / "wg0.conf.tmp"
-    with open(local_tmp, "w") as f:
-        f.write(conf_text)
+    local_tmp = Path("/run/vacuum-wall/wg0.conf.tmp")
+    local_tmp.parent.mkdir(exist_ok=True)
+    local_tmp.write_text(conf_text)
     os.chmod(local_tmp, 0o600)
     run(["cp", "--", str(local_tmp), WG_CONF_PATH], sudo=True)
     run(["chown", "root:root", WG_CONF_PATH], sudo=True, check=False)
@@ -221,9 +219,9 @@ def initialize(_request: Any, _body: Any) -> dict[str, Any]:
     cfg = _get_config()
     if cfg["interface"].get("private_key"):
         return {"initialized": False, "reason": "already initialized"}
-    res = run_proc([WG_BIN, "genkey"], sudo=True)
+    res = run_proc([WG_BIN, "genkey"], sudo=False)
     private_key = res.stdout.strip()
-    res2 = run_proc([WG_BIN, "pubkey"], sudo=True, input=private_key)
+    res2 = run_proc([WG_BIN, "pubkey"], sudo=False, input=private_key)
     public_key = res2.stdout.strip()
     cfg["interface"]["private_key"] = private_key
     cfg["interface"]["public_key"] = public_key