CrowdSec's blacklist chain runs at priority 0. Our loopback accept rule needs to run first so local traffic isn't blocked. Also cleans up .bak files after successful SafeApply.