state: applied-config snapshots + per-field pending diffs

- lib/common: stamp_applied() now records a _last_applied_config
  snapshot alongside the hash; strip_apply_meta() centralizes
  bookkeeping-key stripping; deep_diff() reports field-level changes
- state collectors (dnsmasq/nginx/wireguard/networkd) expose
  pending_diff so the dashboard can show exactly which fields
  changed since the last apply (wireguard diff excludes
  private_key paths)
- dashboard pending-changes card renders per-change lines with a
  generic fallback when no snapshot is recorded
- firewall: firewalld built-in zones no longer flagged as
  unmanaged; public-zone masquerade skipped in pending changes
  since apply drives it via nftables propagation
- schema: PendingChange TypedDict; pending_diff on DnsmasqStatus /
  WgStatus; tests in test_common.py, test_firewall.py, test_state.py

daemon/handlers/wireguard.py

@@ -28,12 +28,7 @@ from daemon.iface import (
     POST_WIREGUARD_PEERS_ADD,
 )
 from daemon.server import ConflictError, NotFoundError, refresh_state, registry
-from lib.common import (
-    _APPLY_HASH_KEY,
-    config_hash,
-    deep_merge,
-    run,
-)
+from lib.common import deep_merge, run, stamp_applied, strip_apply_meta
 from lib.sync import SyncEvent, bus
 from lib.wireguard import (
     _class_interface_name,
@@ -82,7 +77,7 @@ def get_config(_request: Any, _body: Any) -> dict[str, Any]:
     if wg:
         return wg.get("config", {})
     cfg = _get_wireguard_config()
-    safe = {k: v for k, v in cfg.items() if k != _APPLY_HASH_KEY}
+    safe = strip_apply_meta(cfg)
     if "interface" in safe:
         safe["interface"] = dict(safe["interface"])
         safe["interface"].pop("private_key", None)
@@ -220,7 +215,7 @@ def apply(_request: Any, _body: Any) -> dict[str, Any]:
         logger.info("WireGuard tunnel '%s' brought up", ifname)
 
     cfg_after = _get_wireguard_config()
-    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+    stamp_applied(cfg_after)
     _save_wireguard_config(cfg_after)
     sync_result = bus.emit(
         SyncEvent("wireguard", "config_saved", {"action": "config_applied"})