fix: critical bugs + security hardening

Phase 1 (critical bugs):
- Fix firewall import string-to-list bug (system_import.py)
- Add rich rules removal in firewall config apply (handlers/firewall.py)

Phase 2 (security hardening):
- Restrict sudo wildcards to specific paths (sudoers.d/vacuum-walld)
- Fix TOCTOU: use /run/vacuum-wall/ for temp files (nginx, dnsmasq, network handlers)
- Remove unnecessary sudo from wg genkey/pubkey (handlers/wireguard.py)

Phase 3 (validation):
- Validate poll intervals > 0 (daemon/server.py)
- Restrict sysctl to whitelisted parameters (handlers/network.py)

Phase 4 (defensive programming):
- Enforce shell=False in run() and run_proc() (lib/common.py)
- Track issuance tasks for graceful shutdown (handlers/acme.py)
- Add nginx template marker consistency tests (tests/test_system_import.py)

docs/hoover.md

@@ -55,7 +55,7 @@ The app starts from `webui/static/app.js`:
 
 ```javascript
 import { h, render, Link, hComp, ToastContainer, connect, apiFetch,
-         modelRegister, modelFetch, reactive } from '/static/hoover/index.js?v=7';
+         modelRegister, modelFetch, reactive } from '/static/hoover/index.js?v=8';
 
 // 1. Register subsystem models
 modelRegister('firewall', {
@@ -1151,7 +1151,7 @@ Render the toast notification container. Include in the main render root. See AP
 
 ## Versioned Imports
 
-Static assets in `app.js` are imported with querystring version pins (e.g., `?v=7`) to invalidate browser cache when the framework changes. Page imports also include version pins. The server handles caching headers; the version query string ensures browser cache invalidation.
+Static assets in `app.js` are imported with querystring version pins (e.g., `?v=8`) to invalidate browser cache when the framework changes. Page imports also include version pins (e.g., `?v=9`). The server handles caching headers; the version query string ensures browser cache invalidation.
 
 Dev mode (`VACUUM_WALL_DEV` set) disables aggressive static asset caching.