fix: Set nftables input chain priority to -1 for CrowdSec compatibility

CrowdSec's blacklist chain runs at priority 0. Our loopback accept rule
needs to run first so local traffic isn't blocked. Also cleans up .bak
files after successful SafeApply.

internal/nftables/manager_test.go

@@ -43,7 +43,7 @@ func TestGenerate_AlwaysIncludesStructure(t *testing.T) {
 		"table inet wild-central",
 		"set allowed_tcp_ports",
 		"chain input",
-		"type filter hook input priority filter; policy accept;",
+		"type filter hook input priority -1; policy accept;",
 		"iif \"lo\" accept",
 		"ct state { established, related } accept",
 	} {