fix: Clean up .bak files after SafeApply to prevent dnsmasq loading stale configs

dnsmasq loads every file in /etc/dnsmasq.d/ (skipping only .dpkg-*).
SafeApply was leaving .bak backup files after successful applies, causing
duplicate/conflicting DNS records. Also moves dnsmasq's validation temp
file to /tmp so a crash can't leave a .validate file in the conf dir.

internal/dnsmasq/config.go

@@ -303,8 +303,8 @@ log-dhcp
 // SafeApply validates, backs up, writes, restarts, and verifies the dnsmasq config.
 // On restart or verification failure, rolls back to the previous config.
 func (g *Manager) SafeApply(content string) error {
-	// Validate via temp file
-	tmpFile := g.configPath + ".validate"
+	// Validate via temp file (use /tmp to avoid stray files in dnsmasq.d if process crashes)
+	tmpFile := "/tmp/wild-central-dnsmasq-validate.tmp"
 	if err := os.WriteFile(tmpFile, []byte(content), 0644); err != nil {
 		return fmt.Errorf("writing validation file: %w", err)
 	}
@@ -336,6 +336,10 @@ func (g *Manager) SafeApply(content string) error {
 		return fmt.Errorf("health check failed (rolled back): %w", err)
 	}
 
+	// Clean up backup — dnsmasq loads every file in its conf dir,
+	// so stale .bak files cause duplicate/conflicting records.
+	os.Remove(g.configPath + ".bak")
+
 	return nil
 }