state: applied-config snapshots + per-field pending diffs

- lib/common: stamp_applied() now records a _last_applied_config
  snapshot alongside the hash; strip_apply_meta() centralizes
  bookkeeping-key stripping; deep_diff() reports field-level changes
- state collectors (dnsmasq/nginx/wireguard/networkd) expose
  pending_diff so the dashboard can show exactly which fields
  changed since the last apply (wireguard diff excludes
  private_key paths)
- dashboard pending-changes card renders per-change lines with a
  generic fallback when no snapshot is recorded
- firewall: firewalld built-in zones no longer flagged as
  unmanaged; public-zone masquerade skipped in pending changes
  since apply drives it via nftables propagation
- schema: PendingChange TypedDict; pending_diff on DnsmasqStatus /
  WgStatus; tests in test_common.py, test_firewall.py, test_state.py

daemon/handlers/network.py

@@ -21,7 +21,7 @@ from daemon.iface import (
     POST_NETWORK_SYSCTL_SET,
 )
 from daemon.server import NotFoundError, refresh_state, registry
-from lib.common import _APPLY_HASH_KEY, config_hash, run, validate_interface_name
+from lib.common import run, stamp_applied, validate_interface_name
 from lib.dnsmasq import get_config as _get_dm_cfg
 from lib.dnsmasq import save_config as _save_dm_cfg
 from lib.dnsmasq import set_upstreams
@@ -218,7 +218,7 @@ def save_interface(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]
     # even when deployment fails (e.g. in containerized environments).
     # The hash represents the JSON config state, not the system state.
     cfg_after = get_config()
-    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+    stamp_applied(cfg_after)
     save_config(cfg_after)
     sync_result = bus.emit(
         SyncEvent(
@@ -286,16 +286,17 @@ def apply_all(_request: Any, _body: Any) -> dict[str, Any]:
         upstreams = collect_upstream_dns(cfg)
         if upstreams:
             set_upstreams(upstreams)
-            # Update dnsmasq apply hash so pending-changes detection stays correct
+            # Update dnsmasq applied snapshot + hash so pending-changes
+            # detection stays correct
             dm_cfg = _get_dm_cfg()
-            dm_cfg[_APPLY_HASH_KEY] = config_hash(dm_cfg)
+            stamp_applied(dm_cfg)
             _save_dm_cfg(dm_cfg)
             logger.info("Synced %d DNS upstreams to dnsmasq", len(upstreams))
     except Exception:
         logger.warning("Failed to sync DNS upstreams to dnsmasq", exc_info=True)
 
     cfg_after = get_config()
-    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+    stamp_applied(cfg_after)
     save_config(cfg_after)
     sync_result = bus.emit(
         SyncEvent("networkd", "config_saved", {"action": "config_applied"})