state: applied-config snapshots + per-field pending diffs

- lib/common: stamp_applied() now records a _last_applied_config
  snapshot alongside the hash; strip_apply_meta() centralizes
  bookkeeping-key stripping; deep_diff() reports field-level changes
- state collectors (dnsmasq/nginx/wireguard/networkd) expose
  pending_diff so the dashboard can show exactly which fields
  changed since the last apply (wireguard diff excludes
  private_key paths)
- dashboard pending-changes card renders per-change lines with a
  generic fallback when no snapshot is recorded
- firewall: firewalld built-in zones no longer flagged as
  unmanaged; public-zone masquerade skipped in pending changes
  since apply drives it via nftables propagation
- schema: PendingChange TypedDict; pending_diff on DnsmasqStatus /
  WgStatus; tests in test_common.py, test_firewall.py, test_state.py

daemon/handlers/nginx.py

@@ -29,14 +29,14 @@ from daemon.iface import (
 from daemon.server import ConflictError, NotFoundError, refresh_state, registry
 from lib.acme import find_cert_dir
 from lib.common import (
-    _APPLY_HASH_KEY,
-    config_hash,
     deep_merge,
     ensure_dirs,
     load_json,
     run,
     run_proc,
     save_json,
+    stamp_applied,
+    strip_apply_meta,
 )
 from lib.nginx import DEFAULT_SSL, WEBUI_BACKEND
 from lib.nginx import _resolve_auth as _ngx_resolve_auth
@@ -494,7 +494,7 @@ def get_config(_request: Any, _body: Any) -> dict[str, Any]:
     if ng:
         return ng.get("config", {})
     cfg = _get_config()
-    return {k: v for k, v in cfg.items() if k != _APPLY_HASH_KEY}
+    return strip_apply_meta(cfg)
 
 
 @registry.register(POST_NGINX_CONFIG)
@@ -741,7 +741,7 @@ def apply(_request: Any, _body: Any) -> dict[str, Any]:
         raise RuntimeError(f"nginx config test failed: {msg}")
     _reload_nginx()
     cfg_after = _get_config()
-    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+    stamp_applied(cfg_after)
     _save_config(cfg_after)
     refresh_state(["nginx"])
     return {"applied": True}