status: cancel-all reverts pending changes to last applied config

- lib.common.revert_to_applied(): restore a config file from its
  _last_applied_config snapshot (stamped hash); no baseline -> skip with
  reason, file untouched
- firewall config_apply now stamps the applied baseline like the other
  subsystems; GET /firewall/config and the state collector strip the
  internal _last_applied_* keys
- POST /status/cancel-all + /api/status/cancel-all: revert pending
  subsystems, {cancelled, skipped, errors}, partial-failure safe
- dashboard: "Cancel All Changes" button with confirm modal
  (CancelConfirm, reuses the pending-changes modal rows); the pending
  changes card is hidden entirely when nothing is pending
- tests: revert_to_applied, status_cancel_all, firewall stamping/meta
  stripping, /api/status/cancel-all route, node tests for CancelConfirm;
  firewall _config_apply tests no longer write the real repo config
- docs: api.md, state-model.md, config.md, hoover.md

docs/hoover.md

@@ -1172,6 +1172,39 @@ Table({
 })
 ```
 
+### Apply / Cancel
+
+`components/applyconfirm.js` — cross-subsystem apply/cancel buttons with a
+shared expandable-subsystems modal. Both fetch `/api/status/pending` to
+populate the modal rows (`buildRows()`; `SUBSYSTEM_LIST` order: firewall,
+dnsmasq, nginx, wireguard, networkd).
+
+#### `ApplyConfirm(props)`
+
+Button that opens the confirmation modal listing pending subsystems, then
+POSTs `/api/status/apply-all`. When `props.pending` is false it renders a
+disabled "synced" button that toasts on click.
+
+**Parameters:** `pending` (bool), `label`, `syncedLabel`, `cls`,
+`successMsg`, `refresh` (legacy, ignored).
+
+#### `CancelConfirm(props)`
+
+Button that opens the confirmation modal listing the subsystems that
+would be reverted ("Restores the listed subsystems to their last applied
+configuration, discarding changes saved since the last apply"), then
+POSTs `/api/status/cancel-all`. Success toast appends skipped-subsystem
+details when the response has a non-empty `skipped` map; errors from the
+response are toasted separately. State-store models update from the
+daemon's WS delta — no explicit `modelFetch`.
+
+**Parameters:** `label` (default `'Cancel All Changes'`), `cls`
+(default `'btn btn-danger'`).
+
+```javascript
+CancelConfirm({ cls: 'btn btn-sm btn-danger' })
+```
+
 ### Modal
 
 #### `openModal(renderFn)`