state: applied-config snapshots + per-field pending diffs

- lib/common: stamp_applied() now records a _last_applied_config
  snapshot alongside the hash; strip_apply_meta() centralizes
  bookkeeping-key stripping; deep_diff() reports field-level changes
- state collectors (dnsmasq/nginx/wireguard/networkd) expose
  pending_diff so the dashboard can show exactly which fields
  changed since the last apply (wireguard diff excludes
  private_key paths)
- dashboard pending-changes card renders per-change lines with a
  generic fallback when no snapshot is recorded
- firewall: firewalld built-in zones no longer flagged as
  unmanaged; public-zone masquerade skipped in pending changes
  since apply drives it via nftables propagation
- schema: PendingChange TypedDict; pending_diff on DnsmasqStatus /
  WgStatus; tests in test_common.py, test_firewall.py, test_state.py

daemon/handlers/dnsmasq.py

@@ -26,14 +26,14 @@ from daemon.iface import (
 )
 from daemon.server import NotFoundError, refresh_state, registry
 from lib.common import (
-    _APPLY_HASH_KEY,
-    config_hash,
     deep_merge,
     ensure_dirs,
     get_interface_ip,
     load_json,
     run,
     save_json,
+    stamp_applied,
+    strip_apply_meta,
 )
 from lib.sync import SyncEvent, bus
 
@@ -139,7 +139,7 @@ def get_config(_request: Any, _body: Any) -> dict[str, Any]:
     if dm:
         return dm.get("config", {})
     cfg = _get_config()
-    return {k: v for k, v in cfg.items() if k != _APPLY_HASH_KEY}
+    return strip_apply_meta(cfg)
 
 
 @registry.register(POST_DNSMASQ_CONFIG)
@@ -196,9 +196,10 @@ def apply_config(_request: Any, _body: Any) -> dict[str, Any]:
     tmp.unlink(missing_ok=True)
     run(["systemctl", "restart", "dnsmasq"], sudo=True)
     logger.info("dnsmasq config written and restarted")
-    # Store the config hash so state collector can detect pending changes
+    # Store the applied config snapshot + hash so the state collector can
+    # detect pending changes and report what specifically changed.
     cfg_after = _get_config()
-    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+    stamp_applied(cfg_after)
     _save_config(cfg_after)
     sync_result = bus.emit(
         SyncEvent("dnsmasq", "config_saved", {"action": "config_applied"})

daemon/handlers/network.py

@@ -21,7 +21,7 @@ from daemon.iface import (
     POST_NETWORK_SYSCTL_SET,
 )
 from daemon.server import NotFoundError, refresh_state, registry
-from lib.common import _APPLY_HASH_KEY, config_hash, run, validate_interface_name
+from lib.common import run, stamp_applied, validate_interface_name
 from lib.dnsmasq import get_config as _get_dm_cfg
 from lib.dnsmasq import save_config as _save_dm_cfg
 from lib.dnsmasq import set_upstreams
@@ -218,7 +218,7 @@ def save_interface(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]
     # even when deployment fails (e.g. in containerized environments).
     # The hash represents the JSON config state, not the system state.
     cfg_after = get_config()
-    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+    stamp_applied(cfg_after)
     save_config(cfg_after)
     sync_result = bus.emit(
         SyncEvent(
@@ -286,16 +286,17 @@ def apply_all(_request: Any, _body: Any) -> dict[str, Any]:
         upstreams = collect_upstream_dns(cfg)
         if upstreams:
             set_upstreams(upstreams)
-            # Update dnsmasq apply hash so pending-changes detection stays correct
+            # Update dnsmasq applied snapshot + hash so pending-changes
+            # detection stays correct
             dm_cfg = _get_dm_cfg()
-            dm_cfg[_APPLY_HASH_KEY] = config_hash(dm_cfg)
+            stamp_applied(dm_cfg)
             _save_dm_cfg(dm_cfg)
             logger.info("Synced %d DNS upstreams to dnsmasq", len(upstreams))
     except Exception:
         logger.warning("Failed to sync DNS upstreams to dnsmasq", exc_info=True)
 
     cfg_after = get_config()
-    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+    stamp_applied(cfg_after)
     save_config(cfg_after)
     sync_result = bus.emit(
         SyncEvent("networkd", "config_saved", {"action": "config_applied"})

daemon/handlers/nginx.py

@@ -29,14 +29,14 @@ from daemon.iface import (
 from daemon.server import ConflictError, NotFoundError, refresh_state, registry
 from lib.acme import find_cert_dir
 from lib.common import (
-    _APPLY_HASH_KEY,
-    config_hash,
     deep_merge,
     ensure_dirs,
     load_json,
     run,
     run_proc,
     save_json,
+    stamp_applied,
+    strip_apply_meta,
 )
 from lib.nginx import DEFAULT_SSL, WEBUI_BACKEND
 from lib.nginx import _resolve_auth as _ngx_resolve_auth
@@ -494,7 +494,7 @@ def get_config(_request: Any, _body: Any) -> dict[str, Any]:
     if ng:
         return ng.get("config", {})
     cfg = _get_config()
-    return {k: v for k, v in cfg.items() if k != _APPLY_HASH_KEY}
+    return strip_apply_meta(cfg)
 
 
 @registry.register(POST_NGINX_CONFIG)
@@ -741,7 +741,7 @@ def apply(_request: Any, _body: Any) -> dict[str, Any]:
         raise RuntimeError(f"nginx config test failed: {msg}")
     _reload_nginx()
     cfg_after = _get_config()
-    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+    stamp_applied(cfg_after)
     _save_config(cfg_after)
     refresh_state(["nginx"])
     return {"applied": True}

daemon/handlers/wireguard.py

@@ -28,12 +28,7 @@ from daemon.iface import (
     POST_WIREGUARD_PEERS_ADD,
 )
 from daemon.server import ConflictError, NotFoundError, refresh_state, registry
-from lib.common import (
-    _APPLY_HASH_KEY,
-    config_hash,
-    deep_merge,
-    run,
-)
+from lib.common import deep_merge, run, stamp_applied, strip_apply_meta
 from lib.sync import SyncEvent, bus
 from lib.wireguard import (
     _class_interface_name,
@@ -82,7 +77,7 @@ def get_config(_request: Any, _body: Any) -> dict[str, Any]:
     if wg:
         return wg.get("config", {})
     cfg = _get_wireguard_config()
-    safe = {k: v for k, v in cfg.items() if k != _APPLY_HASH_KEY}
+    safe = strip_apply_meta(cfg)
     if "interface" in safe:
         safe["interface"] = dict(safe["interface"])
         safe["interface"].pop("private_key", None)
@@ -220,7 +215,7 @@ def apply(_request: Any, _body: Any) -> dict[str, Any]:
         logger.info("WireGuard tunnel '%s' brought up", ifname)
 
     cfg_after = _get_wireguard_config()
-    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+    stamp_applied(cfg_after)
     _save_wireguard_config(cfg_after)
     sync_result = bus.emit(
         SyncEvent("wireguard", "config_saved", {"action": "config_applied"})