status: cancel-all reverts pending changes to last applied config

- lib.common.revert_to_applied(): restore a config file from its
  _last_applied_config snapshot (stamped hash); no baseline -> skip with
  reason, file untouched
- firewall config_apply now stamps the applied baseline like the other
  subsystems; GET /firewall/config and the state collector strip the
  internal _last_applied_* keys
- POST /status/cancel-all + /api/status/cancel-all: revert pending
  subsystems, {cancelled, skipped, errors}, partial-failure safe
- dashboard: "Cancel All Changes" button with confirm modal
  (CancelConfirm, reuses the pending-changes modal rows); the pending
  changes card is hidden entirely when nothing is pending
- tests: revert_to_applied, status_cancel_all, firewall stamping/meta
  stripping, /api/status/cancel-all route, node tests for CancelConfirm;
  firewall _config_apply tests no longer write the real repo config
- docs: api.md, state-model.md, config.md, hoover.md

docs/api.md

@@ -1962,7 +1962,8 @@ Aggregate pending changes across all subsystems. Useful for the dashboard to sho
 
 | Field | Type | Description |
 |-------|------|-------------|
-| `subsystems` | `object` | Map of subsystem name to pending status |
+| `firewall` | `object` | `{ needs_apply, change_count, changes: [{summary, detail}] }` |
+| `dnsmasq` / `nginx` / `wireguard` / `networkd` | `object` | `{ pending_changes, summary, changes: [{summary, detail}] }` |
 | `total_changes` | `number` | Total count of pending changes across all subsystems |
 
 ---
@@ -1984,6 +1985,31 @@ Apply pending changes for all subsystems in dependency order.
 
 ---
 
+#### Cancel All Pending Changes
+
+```
+POST /api/status/cancel-all
+```
+
+Revert pending changes for all subsystems to the last applied
+configuration. Restores each pending subsystem's `config.json` from its
+recorded `_last_applied_config` snapshot, discarding unapplied edits.
+Subsystems without a recorded baseline (config never applied) are
+reported as skipped and left untouched. No live-system commands run —
+only the declarative config files are written.
+
+**Request Body:** none.
+
+**Response (`data`):**
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `cancelled` | `[string, ...]` | Subsystems reverted to their last applied config |
+| `skipped` | `object` | Map of subsystem label → reason (e.g. "No baseline recorded (never applied)") |
+| `errors` | `object` | Map of subsystem label → error message |
+
+---
+
 #### Refresh State
 
 ```