fix: critical bugs + security hardening

Phase 1 (critical bugs):
- Fix firewall import string-to-list bug (system_import.py)
- Add rich rules removal in firewall config apply (handlers/firewall.py)

Phase 2 (security hardening):
- Restrict sudo wildcards to specific paths (sudoers.d/vacuum-walld)
- Fix TOCTOU: use /run/vacuum-wall/ for temp files (nginx, dnsmasq, network handlers)
- Remove unnecessary sudo from wg genkey/pubkey (handlers/wireguard.py)

Phase 3 (validation):
- Validate poll intervals > 0 (daemon/server.py)
- Restrict sysctl to whitelisted parameters (handlers/network.py)

Phase 4 (defensive programming):
- Enforce shell=False in run() and run_proc() (lib/common.py)
- Track issuance tasks for graceful shutdown (handlers/acme.py)
- Add nginx template marker consistency tests (tests/test_system_import.py)

tests/test_system_import.py

@@ -642,3 +642,30 @@ class TestCfgsEqual:
         a = {"dhcp": {"ranges": [{"start": "1.2.3.4"}]}}
         b = {"dhcp": {"ranges": [{"start": "1.2.3.4"}]}}
         assert system_import._cfgs_equal(a, b)
+
+
+# ──────────────────────────────────────────────────────────────────────
+# Template marker consistency
+# ──────────────────────────────────────────────────────────────────────
+
+
+class TestTemplateMarker:
+    """Verify nginx templates contain the expected auto-generated marker."""
+
+    def test_acme_challenge_has_marker(self):
+        content = (
+            Path(__file__).resolve().parent.parent
+            / "system"
+            / "nginx"
+            / "acme-challenge.conf"
+        ).read_text()
+        assert "# Auto-generated by Vacuum Wall" in content
+
+    def test_server_block_has_marker(self):
+        content = (
+            Path(__file__).resolve().parent.parent
+            / "system"
+            / "nginx"
+            / "server_block.conf"
+        ).read_text()
+        assert "# Auto-generated by Vacuum Wall" in content