state: applied-config snapshots + per-field pending diffs

- lib/common: stamp_applied() now records a _last_applied_config
  snapshot alongside the hash; strip_apply_meta() centralizes
  bookkeeping-key stripping; deep_diff() reports field-level changes
- state collectors (dnsmasq/nginx/wireguard/networkd) expose
  pending_diff so the dashboard can show exactly which fields
  changed since the last apply (wireguard diff excludes
  private_key paths)
- dashboard pending-changes card renders per-change lines with a
  generic fallback when no snapshot is recorded
- firewall: firewalld built-in zones no longer flagged as
  unmanaged; public-zone masquerade skipped in pending changes
  since apply drives it via nftables propagation
- schema: PendingChange TypedDict; pending_diff on DnsmasqStatus /
  WgStatus; tests in test_common.py, test_firewall.py, test_state.py

daemon/handlers/dnsmasq.py

@@ -26,14 +26,14 @@ from daemon.iface import (
 )
 from daemon.server import NotFoundError, refresh_state, registry
 from lib.common import (
-    _APPLY_HASH_KEY,
-    config_hash,
     deep_merge,
     ensure_dirs,
     get_interface_ip,
     load_json,
     run,
     save_json,
+    stamp_applied,
+    strip_apply_meta,
 )
 from lib.sync import SyncEvent, bus
 
@@ -139,7 +139,7 @@ def get_config(_request: Any, _body: Any) -> dict[str, Any]:
     if dm:
         return dm.get("config", {})
     cfg = _get_config()
-    return {k: v for k, v in cfg.items() if k != _APPLY_HASH_KEY}
+    return strip_apply_meta(cfg)
 
 
 @registry.register(POST_DNSMASQ_CONFIG)
@@ -196,9 +196,10 @@ def apply_config(_request: Any, _body: Any) -> dict[str, Any]:
     tmp.unlink(missing_ok=True)
     run(["systemctl", "restart", "dnsmasq"], sudo=True)
     logger.info("dnsmasq config written and restarted")
-    # Store the config hash so state collector can detect pending changes
+    # Store the applied config snapshot + hash so the state collector can
+    # detect pending changes and report what specifically changed.
     cfg_after = _get_config()
-    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+    stamp_applied(cfg_after)
     _save_config(cfg_after)
     sync_result = bus.emit(
         SyncEvent("dnsmasq", "config_saved", {"action": "config_applied"})