fix: critical bugs + security hardening

Phase 1 (critical bugs):
- Fix firewall import string-to-list bug (system_import.py)
- Add rich rules removal in firewall config apply (handlers/firewall.py)

Phase 2 (security hardening):
- Restrict sudo wildcards to specific paths (sudoers.d/vacuum-walld)
- Fix TOCTOU: use /run/vacuum-wall/ for temp files (nginx, dnsmasq, network handlers)
- Remove unnecessary sudo from wg genkey/pubkey (handlers/wireguard.py)

Phase 3 (validation):
- Validate poll intervals > 0 (daemon/server.py)
- Restrict sysctl to whitelisted parameters (handlers/network.py)

Phase 4 (defensive programming):
- Enforce shell=False in run() and run_proc() (lib/common.py)
- Track issuance tasks for graceful shutdown (handlers/acme.py)
- Add nginx template marker consistency tests (tests/test_system_import.py)

docs/overview.md

@@ -93,15 +93,17 @@ After installation, access the management interface at `https://<hostname>.local
 │   ├── dnsmasq.conf         # Dnsmasq template (rendered at runtime)
 │   └── wireguard*.conf      # WireGuard templates (rendered at runtime)
 ├── lib/                     # Subsystem abstraction layer
-│   ├── common.py            # Shared utilities (run, run_proc, load_json, save_json, deep_merge, ensure_dirs)
+│   ├── common.py            # Shared utilities (run, run_proc, load_json, save_json, deep_merge, ensure_dirs, get_interface_ip)
 │   ├── logging.py           # Logging setup
 │   ├── firewall.py          # firewalld bindings
 │   ├── network.py           # systemd-networkd rendering & parsing
 │   ├── dnsmasq.py           # DHCP/DNS configuration
 │   ├── nginx.py             # Reverse proxy configuration
 │   ├── state.py             # State collector (uses lib.network.parse_networkctl_status)
+│   ├── sync.py              # Cross-subsystem event bus
 │   ├── acme.py              # Certificate management (ACME helpers)
-│   └── wireguard.py         # VPN tunnel and peer management
+│   ├── wireguard.py         # VPN tunnel and peer management
+│   └── system_import.py     # Startup reconciler (imports live system configs into JSON)
 ├── webui/                   # Flask web application
 │   ├── server.py            # Application entry point
 │   ├── api/                 # REST API route modules (blueprints)