fix: Set nftables input chain priority to -1 for CrowdSec compatibility

CrowdSec's blacklist chain runs at priority 0. Our loopback accept rule
needs to run first so local traffic isn't blocked. Also cleans up .bak
files after successful SafeApply.

internal/nftables/manager.go

@@ -96,7 +96,8 @@ func (m *Manager) Generate(haproxyPorts []int, extraTCPPorts []int, extraUDPPort
 	sb.WriteString("    }\n\n")
 
 	sb.WriteString("    chain input {\n")
-	sb.WriteString("        type filter hook input priority filter; policy accept;\n\n")
+	sb.WriteString("        # Priority -1 so loopback accept runs before CrowdSec's blacklist chain (priority 0)\n")
+	sb.WriteString("        type filter hook input priority -1; policy accept;\n\n")
 	sb.WriteString("        iif \"lo\" accept\n")
 	sb.WriteString("        ct state { established, related } accept\n")
 
@@ -180,6 +181,8 @@ func (m *Manager) SafeApply(content string) error {
 		return fmt.Errorf("verification failed (rolled back): %w", err)
 	}
 
+	os.Remove(m.rulesPath + ".bak")
+
 	return nil
 }
 

internal/nftables/manager_test.go

@@ -43,7 +43,7 @@ func TestGenerate_AlwaysIncludesStructure(t *testing.T) {
 		"table inet wild-central",
 		"set allowed_tcp_ports",
 		"chain input",
-		"type filter hook input priority filter; policy accept;",
+		"type filter hook input priority -1; policy accept;",
 		"iif \"lo\" accept",
 		"ct state { established, related } accept",
 	} {