fix: critical bugs + security hardening

Phase 1 (critical bugs):
- Fix firewall import string-to-list bug (system_import.py)
- Add rich rules removal in firewall config apply (handlers/firewall.py)

Phase 2 (security hardening):
- Restrict sudo wildcards to specific paths (sudoers.d/vacuum-walld)
- Fix TOCTOU: use /run/vacuum-wall/ for temp files (nginx, dnsmasq, network handlers)
- Remove unnecessary sudo from wg genkey/pubkey (handlers/wireguard.py)

Phase 3 (validation):
- Validate poll intervals > 0 (daemon/server.py)
- Restrict sysctl to whitelisted parameters (handlers/network.py)

Phase 4 (defensive programming):
- Enforce shell=False in run() and run_proc() (lib/common.py)
- Track issuance tasks for graceful shutdown (handlers/acme.py)
- Add nginx template marker consistency tests (tests/test_system_import.py)

lib/state.py

@@ -656,10 +656,15 @@ def _collect_nginx() -> dict[str, Any]:
             pass
 
     # Build flattened domains list (one entry per path)
+    from lib.nginx import _resolve_paths as _ngx_resolve_paths
+
+    backends = cfg.get("backends", {})
     domains: list[dict[str, Any]] = []
     for name, dom in cfg.get("domains", {}).items():
+        if "backend" not in dom:
+            continue
         site = SITES_DIR / f"{name}.conf"
-        paths = dom.get("paths", {})
+        paths = _ngx_resolve_paths(dom, backends)
         if not paths:
             continue
         for ppath, pcfg in paths.items():
@@ -669,6 +674,7 @@ def _collect_nginx() -> dict[str, Any]:
                 "backend": pcfg.get("backend", {}),
                 "online": site.exists() if SITES_DIR.exists() else False,
                 "force_ssl": dom.get("force_ssl", True),
+                "backend_name": dom["backend"],
                 "cert": dom.get("cert"),
             }
             if pcfg.get("is_management"):