status: cancel-all reverts pending changes to last applied config

- lib.common.revert_to_applied(): restore a config file from its
  _last_applied_config snapshot (stamped hash); no baseline -> skip with
  reason, file untouched
- firewall config_apply now stamps the applied baseline like the other
  subsystems; GET /firewall/config and the state collector strip the
  internal _last_applied_* keys
- POST /status/cancel-all + /api/status/cancel-all: revert pending
  subsystems, {cancelled, skipped, errors}, partial-failure safe
- dashboard: "Cancel All Changes" button with confirm modal
  (CancelConfirm, reuses the pending-changes modal rows); the pending
  changes card is hidden entirely when nothing is pending
- tests: revert_to_applied, status_cancel_all, firewall stamping/meta
  stripping, /api/status/cancel-all route, node tests for CancelConfirm;
  firewall _config_apply tests no longer write the real repo config
- docs: api.md, state-model.md, config.md, hoover.md

daemon/handlers/firewall.py

@@ -34,7 +34,7 @@ from daemon.iface import (
     POST_FIREWALL_ZONES_SERVICES,
 )
 from daemon.server import ConflictError, NotFoundError, refresh_state, registry
-from lib.common import load_json, run, save_json
+from lib.common import load_json, run, save_json, stamp_applied, strip_apply_meta
 from lib.firewall import (
     _normalize_target,
     _parse_active_zones,
@@ -391,6 +391,11 @@ def _config_apply(force: bool = False) -> dict[str, Any]:
         "timestamp": "",
     }
     backup_path = _save_backup(full_state)
+    # Record the applied config snapshot + hash so pending-changes detection
+    # and cancel/revert work like the hash-based subsystems.
+    applied_cfg = _get_config()
+    stamp_applied(applied_cfg)
+    _save_config(applied_cfg)
     logger.info("Firewall config applied to %d zones", len(applied))
     return {
         "applied_zones": applied,
@@ -506,9 +511,9 @@ def get_config(_request: Any, _body: Any) -> dict[str, Any]:
         _body: The request body (unused).
 
     Returns:
-        Full firewall config dict.
+        Full firewall config dict (apply bookkeeping keys stripped).
     """
-    return _get_config()
+    return strip_apply_meta(_get_config())
 
 
 @registry.register(POST_FIREWALL_CONFIG)