fix: Clean up .bak files after SafeApply to prevent dnsmasq loading stale configs

dnsmasq loads every file in /etc/dnsmasq.d/ (skipping only .dpkg-*).
SafeApply was leaving .bak backup files after successful applies, causing
duplicate/conflicting DNS records. Also moves dnsmasq's validation temp
file to /tmp so a crash can't leave a .validate file in the conf dir.

internal/haproxy/config.go

@@ -576,6 +576,8 @@ func (m *Manager) SafeApply(content string) error {
 		return fmt.Errorf("health check failed (rolled back): %w", err)
 	}
 
+	os.Remove(m.configPath + ".bak")
+
 	return nil
 }