state: applied-config snapshots + per-field pending diffs

- lib/common: stamp_applied() now records a _last_applied_config
  snapshot alongside the hash; strip_apply_meta() centralizes
  bookkeeping-key stripping; deep_diff() reports field-level changes
- state collectors (dnsmasq/nginx/wireguard/networkd) expose
  pending_diff so the dashboard can show exactly which fields
  changed since the last apply (wireguard diff excludes
  private_key paths)
- dashboard pending-changes card renders per-change lines with a
  generic fallback when no snapshot is recorded
- firewall: firewalld built-in zones no longer flagged as
  unmanaged; public-zone masquerade skipped in pending changes
  since apply drives it via nftables propagation
- schema: PendingChange TypedDict; pending_diff on DnsmasqStatus /
  WgStatus; tests in test_common.py, test_firewall.py, test_state.py

lib/firewall.py

@@ -22,6 +22,22 @@ CONFIG_FILE: Path = CONFIG_DIR / "config.json"
 
 DEFAULT_CONFIG: dict[str, Any] = {"zones": {}}
 
+# Zones firewalld ships by default. They are always present live and are
+# never meaningful to flag as "unmanaged (not in config)".
+FIREWALLD_BUILTIN_ZONES: frozenset[str] = frozenset(
+    {
+        "block",
+        "dmz",
+        "drop",
+        "external",
+        "home",
+        "host",
+        "internal",
+        "public",
+        "trusted",
+    }
+)
+
 
 # ---------------------------------------------------------------------------
 # Internal helpers
@@ -313,17 +329,22 @@ def _compute_pending_changes(
                 }
             )
 
-        cfg_mq = zone_cfg.get("masquerade", False)
-        live_mq = live_zone.get("masquerade", False)
-        if cfg_mq != live_mq:
-            changes.append(
-                {
-                    "zone": zone_name,
-                    "type": "masquerade",
-                    "config": cfg_mq,
-                    "live": live_mq,
-                }
-            )
+        # public zone masquerade is not reconciled by apply (it is driven by
+        # the nftables propagation step in daemon/handlers/firewall.py), so
+        # reporting it as pending here would advertise a change that never
+        # happens. Skip it to keep the diff consistent with apply.
+        if zone_name != "public":
+            cfg_mq = zone_cfg.get("masquerade", False)
+            live_mq = live_zone.get("masquerade", False)
+            if cfg_mq != live_mq:
+                changes.append(
+                    {
+                        "zone": zone_name,
+                        "type": "masquerade",
+                        "config": cfg_mq,
+                        "live": live_mq,
+                    }
+                )
 
         cfg_rules = {r.get("rule") for r in zone_cfg.get("rich_rules", [])}
         live_rules = set(live_zone.get("rich-rules", []))
@@ -356,7 +377,7 @@ def _compute_pending_changes(
             )
 
     for zone_name in live_zones:
-        if zone_name not in cfg_zones:
+        if zone_name not in cfg_zones and zone_name not in FIREWALLD_BUILTIN_ZONES:
             unknown_live[zone_name] = {
                 "interfaces": live_zones[zone_name].get("interfaces", []),
             }
@@ -415,6 +436,7 @@ __all__ = [
     "CONFIG_FILE",
     "DATA_DIR",
     "DEFAULT_CONFIG",
+    "FIREWALLD_BUILTIN_ZONES",
     "RULES_FILE",
     "_compute_pending_changes",
     "_ensure_config_file",