state: applied-config snapshots + per-field pending diffs

- lib/common: stamp_applied() now records a _last_applied_config
  snapshot alongside the hash; strip_apply_meta() centralizes
  bookkeeping-key stripping; deep_diff() reports field-level changes
- state collectors (dnsmasq/nginx/wireguard/networkd) expose
  pending_diff so the dashboard can show exactly which fields
  changed since the last apply (wireguard diff excludes
  private_key paths)
- dashboard pending-changes card renders per-change lines with a
  generic fallback when no snapshot is recorded
- firewall: firewalld built-in zones no longer flagged as
  unmanaged; public-zone masquerade skipped in pending changes
  since apply drives it via nftables propagation
- schema: PendingChange TypedDict; pending_diff on DnsmasqStatus /
  WgStatus; tests in test_common.py, test_firewall.py, test_state.py

lib/system_import.py

@@ -949,7 +949,7 @@ def import_firewall() -> bool:
 
 
 def _cfgs_equal(a: dict[str, Any], b: dict[str, Any]) -> bool:
-    """Compare two configs ignoring _last_applied_hash."""
-    a_clean = {k: v for k, v in a.items() if k != "_last_applied_hash"}
-    b_clean = {k: v for k, v in b.items() if k != "_last_applied_hash"}
-    return a_clean == b_clean
+    """Compare two configs ignoring apply bookkeeping keys."""
+    from lib.common import strip_apply_meta
+
+    return strip_apply_meta(a) == strip_apply_meta(b)