fix: critical bugs + security hardening

Phase 1 (critical bugs):
- Fix firewall import string-to-list bug (system_import.py)
- Add rich rules removal in firewall config apply (handlers/firewall.py)

Phase 2 (security hardening):
- Restrict sudo wildcards to specific paths (sudoers.d/vacuum-walld)
- Fix TOCTOU: use /run/vacuum-wall/ for temp files (nginx, dnsmasq, network handlers)
- Remove unnecessary sudo from wg genkey/pubkey (handlers/wireguard.py)

Phase 3 (validation):
- Validate poll intervals > 0 (daemon/server.py)
- Restrict sysctl to whitelisted parameters (handlers/network.py)

Phase 4 (defensive programming):
- Enforce shell=False in run() and run_proc() (lib/common.py)
- Track issuance tasks for graceful shutdown (handlers/acme.py)
- Add nginx template marker consistency tests (tests/test_system_import.py)

webui/static/app.js

@@ -7,6 +7,7 @@ import RulesPage from '/static/pages/rules.js?v=9';
 import NatPage from '/static/pages/nat.js?v=9';
 import DhcpPage from '/static/pages/dhcp.js?v=9';
 import ProxyPage from '/static/pages/proxy.js?v=9';
+import BackendsPage from '/static/pages/backends.js?v=9';
 import CertsPage from '/static/pages/certs.js?v=9';
 import WireguardPage from '/static/pages/wireguard.js?v=9';
 import LogsPage from '/static/pages/logs.js?v=9';
@@ -21,6 +22,7 @@ const Nav = [
     { path: '/nat',        label: 'NAT'        },
     { path: '/dhcp',       label: 'DHCP'       },
     { path: '/proxy',      label: 'Proxy'      },
+    { path: '/backends',   label: 'Backends'   },
     { path: '/certs',      label: 'Certs'      },
     { path: '/wireguard',  label: 'WireGuard'  },
     { path: '/logs',       label: 'Logs'       },
@@ -97,6 +99,15 @@ modelRegister('nginx', {
     },
 });
 
+modelRegister('backends', {
+    subsystem: 'nginx',
+    fetch: async () => {
+        const r = await apiFetch('/api/proxy/backends');
+        if (!r.ok) throw new Error(r.error);
+        return r.data || {};
+    },
+});
+
 modelRegister('acme', {
     subsystem: 'acme',
     fetch: async () => {
@@ -156,7 +167,7 @@ modelRegister('logs', {
 });
 
 /* ── Initial fetch ─────────────────────────────────────────── */
-for (const name of ['status', 'firewall', 'network', 'dnsmasq', 'nginx', 'wireguard', 'acme']) {
+for (const name of ['status', 'firewall', 'network', 'dnsmasq', 'nginx', 'backends', 'wireguard', 'acme']) {
     modelFetch(name);
 }
 modelFetch('logs', 'journal');
@@ -170,6 +181,7 @@ const Pages = {
     nat:         NatPage,
     dhcp:        DhcpPage,
     proxy:       ProxyPage,
+    backends:    BackendsPage,
     certs:       CertsPage,
     wireguard:   WireguardPage,
     logs:        LogsPage,