ws: migrate push stream to data streaming

- daemon: send full snapshot on connect; versions/tick now carry the
  full state of one subsystem (subsystem + data); no legacy
  updated/subsystems payloads; refresh_state and POST /status/refresh
  broadcast per-subsystem versions with data
- client: modelSet() patches models in place; onMessage/topic refresh
  retired; 3s initial-load fallback via new POST /api/status/refresh
- schema: lib/schema.py TypedDicts + hoover/schema.js defaults +
  docs/state-model.md as single source of truth for state shapes
- system: poll at 1s, volatile metrics registered, dashboard uses a
  dedicated system model (status model removed)
- firewall: refuse to strip both https and ssh from the default zone
  (409, force override via UI confirm); set_zone_services persists
  services to the declarative config; collector exposes default_zone
- UI: pages migrate to flat state shapes; post-mutation modelFetch
  refreshes removed (WS delta covers it)
- tests: ws snapshot/delta/broadcast, refresh-state, schema types,
  model-set/js ws handler and reconnect fallback

webui/api/status.py

@@ -7,10 +7,15 @@ from __future__ import annotations
 
 import logging
 
-from flask import Blueprint
+from flask import Blueprint, request
 
 from daemon.client import get, post
-from daemon.iface import GET_STATUS_PENDING, GET_SYSTEM_METRICS, POST_STATUS_APPLY_ALL
+from daemon.iface import (
+    GET_STATUS_PENDING,
+    GET_SYSTEM_METRICS,
+    POST_STATUS_APPLY_ALL,
+    POST_STATUS_REFRESH,
+)
 from webui.api.common import _error, _ok
 
 logger = logging.getLogger(__name__)
@@ -51,6 +56,23 @@ def apply_all():
         return _error(str(exc), 500)
 
 
+@bp.route("/refresh", methods=["POST"])
+def refresh():
+    """Re-collect state from the daemon, optionally filtered by subsystem.
+
+    Endpoint:
+        POST /api/status/refresh
+    Body:
+        {"subsystems": ["firewall"]} or {} for all.
+    """
+    body = request.get_json(silent=True) or {}
+    try:
+        return _ok(post(POST_STATUS_REFRESH, body))
+    except RuntimeError as exc:
+        logger.error("Failed to refresh state: %s", exc)
+        return _error(str(exc), 500)
+
+
 @bp.route("/system-metrics", methods=["GET"])
 def system_metrics():
     """Retrieve system-wide metrics.