status: cancel-all reverts pending changes to last applied config

- lib.common.revert_to_applied(): restore a config file from its
  _last_applied_config snapshot (stamped hash); no baseline -> skip with
  reason, file untouched
- firewall config_apply now stamps the applied baseline like the other
  subsystems; GET /firewall/config and the state collector strip the
  internal _last_applied_* keys
- POST /status/cancel-all + /api/status/cancel-all: revert pending
  subsystems, {cancelled, skipped, errors}, partial-failure safe
- dashboard: "Cancel All Changes" button with confirm modal
  (CancelConfirm, reuses the pending-changes modal rows); the pending
  changes card is hidden entirely when nothing is pending
- tests: revert_to_applied, status_cancel_all, firewall stamping/meta
  stripping, /api/status/cancel-all route, node tests for CancelConfirm;
  firewall _config_apply tests no longer write the real repo config
- docs: api.md, state-model.md, config.md, hoover.md

lib/state.py

@@ -517,12 +517,12 @@ def _collect_firewall() -> schema.FirewallState:
     except Exception:
         pass
 
-    # Load config
+    # Load config (strip apply bookkeeping keys, as the other collectors do)
     fw_config_path = PROJECT_DIR / "config" / "firewall" / "config.json"
     config_data = {}
     if fw_config_path.exists():
         with contextlib.suppress(Exception):
-            config_data = load_json(fw_config_path)
+            config_data = strip_apply_meta(load_json(fw_config_path))
 
     # Pending changes
     full_state = {