Optimize firewall state collection and improve daemon shutdown

- Replace per-zone --list-all calls with single --list-all-zones in _collect_firewall
- Add _parse_all_zones_output() parser with rich rules/rich-rules normalization
- Convert daemon shutdown to async with proper runner cleanup and socket unlink
- Add TimeoutStopSec=15 to vacuum-walld.service for graceful stop
- Fix exception handling in _collect_dnsmasq
- Remove management badge from proxy path rows

daemon/server.py

@@ -532,13 +532,21 @@ def main() -> None:
 
     loop = asyncio.new_event_loop()
 
-    def _on_shutdown(_sig: int) -> None:
+    async def _shutdown() -> None:
+        """Graceful shutdown: cancel poller, close runner, teardown."""
         logger.info("Shutting down daemon...")
         _stop_polling()
-        loop.stop()
+        try:
+            await asyncio.wait_for(runner.cleanup(), timeout=5)
+        except asyncio.TimeoutError:
+            logger.warning("Runner cleanup timed out, abandoning")
+        if Path(socket_path).exists():
+            os.unlink(socket_path)
+        logger.info("vacuum-walld stopped")
+        loop.call_soon(loop.stop)
 
     for sig in (signal.SIGTERM, signal.SIGINT):
-        loop.add_signal_handler(sig, _on_shutdown, sig)
+        loop.add_signal_handler(sig, lambda: loop.create_task(_shutdown()))
 
     runner = web.AppRunner(app)
     loop.run_until_complete(runner.setup())
@@ -562,10 +570,11 @@ def main() -> None:
     try:
         loop.run_forever()
     finally:
-        loop.run_until_complete(runner.cleanup())
+        # _shutdown() handles cleanup when invoked via signal handler;
+        # this block is only reached if shutdown didn't happen cleanly
+        # (e.g., unexpected exit), in which case we unlink the socket.
         if Path(socket_path).exists():
             os.unlink(socket_path)
-        logger.info("vacuum-walld stopped")
 
 
 if __name__ == "__main__":