fix: critical bugs + security hardening

Phase 1 (critical bugs):
- Fix firewall import string-to-list bug (system_import.py)
- Add rich rules removal in firewall config apply (handlers/firewall.py)

Phase 2 (security hardening):
- Restrict sudo wildcards to specific paths (sudoers.d/vacuum-walld)
- Fix TOCTOU: use /run/vacuum-wall/ for temp files (nginx, dnsmasq, network handlers)
- Remove unnecessary sudo from wg genkey/pubkey (handlers/wireguard.py)

Phase 3 (validation):
- Validate poll intervals > 0 (daemon/server.py)
- Restrict sysctl to whitelisted parameters (handlers/network.py)

Phase 4 (defensive programming):
- Enforce shell=False in run() and run_proc() (lib/common.py)
- Track issuance tasks for graceful shutdown (handlers/acme.py)
- Add nginx template marker consistency tests (tests/test_system_import.py)

daemon/iface.py

@@ -45,6 +45,10 @@ POST_NGINX_TEST: Endpoint = _ep("POST", "/nginx/test")
 POST_NGINX_SSL_APPLY: Endpoint = _ep("POST", "/nginx/ssl-apply")
 
 POST_NGINX_RELOAD: Endpoint = _ep("POST", "/nginx/reload")
+GET_NGINX_BACKENDS: Endpoint = _ep("GET", "/nginx/backends")
+PATCH_NGINX_BACKENDS: Endpoint = _ep("PATCH", "/nginx/backends")
+POST_NGINX_BACKENDS_ADD: Endpoint = _ep("POST", "/nginx/backends/add")
+DELETE_NGINX_BACKENDS_REMOVE: Endpoint = _ep("DELETE", "/nginx/backends/remove")
 
 # ---- Firewall ----
 GET_FIREWALL_INTERFACES: Endpoint = _ep("GET", "/firewall/interfaces")