fix: Set nftables input chain priority to -1 for CrowdSec compatibility

CrowdSec's blacklist chain runs at priority 0. Our loopback accept rule
needs to run first so local traffic isn't blocked. Also cleans up .bak
files after successful SafeApply.

internal/nftables/manager.go

@@ -96,7 +96,8 @@ func (m *Manager) Generate(haproxyPorts []int, extraTCPPorts []int, extraUDPPort
 	sb.WriteString("    }\n\n")
 
 	sb.WriteString("    chain input {\n")
-	sb.WriteString("        type filter hook input priority filter; policy accept;\n\n")
+	sb.WriteString("        # Priority -1 so loopback accept runs before CrowdSec's blacklist chain (priority 0)\n")
+	sb.WriteString("        type filter hook input priority -1; policy accept;\n\n")
 	sb.WriteString("        iif \"lo\" accept\n")
 	sb.WriteString("        ct state { established, related } accept\n")
 
@@ -180,6 +181,8 @@ func (m *Manager) SafeApply(content string) error {
 		return fmt.Errorf("verification failed (rolled back): %w", err)
 	}
 
+	os.Remove(m.rulesPath + ".bak")
+
 	return nil
 }