fix: critical bugs + security hardening

Phase 1 (critical bugs):
- Fix firewall import string-to-list bug (system_import.py)
- Add rich rules removal in firewall config apply (handlers/firewall.py)

Phase 2 (security hardening):
- Restrict sudo wildcards to specific paths (sudoers.d/vacuum-walld)
- Fix TOCTOU: use /run/vacuum-wall/ for temp files (nginx, dnsmasq, network handlers)
- Remove unnecessary sudo from wg genkey/pubkey (handlers/wireguard.py)

Phase 3 (validation):
- Validate poll intervals > 0 (daemon/server.py)
- Restrict sysctl to whitelisted parameters (handlers/network.py)

Phase 4 (defensive programming):
- Enforce shell=False in run() and run_proc() (lib/common.py)
- Track issuance tasks for graceful shutdown (handlers/acme.py)
- Add nginx template marker consistency tests (tests/test_system_import.py)

daemon/server.py

@@ -34,7 +34,15 @@ if _RAW_POLL:
         if ":" in pair:
             name, _, val = pair.partition(":")
             try:
-                _POLL_OVERRIDE[name.strip()] = int(val.strip())
+                parsed = int(val.strip())
+                if parsed <= 0:
+                    logger.warning(
+                        "Invalid poll interval value %r for %r (must be > 0), skipping",
+                        val,
+                        name,
+                    )
+                    continue
+                _POLL_OVERRIDE[name.strip()] = parsed
             except ValueError:
                 logger.warning(
                     "Invalid poll interval value %r for %r, skipping", val, name
@@ -560,6 +568,7 @@ def main() -> None:
 
     # Import system configs → JSON (blocking — OK at startup)
     from lib.system_import import import_all
+
     reconciled = import_all()
     if reconciled:
         logger.info("Reconciled subsystems: %s", ", ".join(reconciled))