status: cancel-all reverts pending changes to last applied config

- lib.common.revert_to_applied(): restore a config file from its
  _last_applied_config snapshot (stamped hash); no baseline -> skip with
  reason, file untouched
- firewall config_apply now stamps the applied baseline like the other
  subsystems; GET /firewall/config and the state collector strip the
  internal _last_applied_* keys
- POST /status/cancel-all + /api/status/cancel-all: revert pending
  subsystems, {cancelled, skipped, errors}, partial-failure safe
- dashboard: "Cancel All Changes" button with confirm modal
  (CancelConfirm, reuses the pending-changes modal rows); the pending
  changes card is hidden entirely when nothing is pending
- tests: revert_to_applied, status_cancel_all, firewall stamping/meta
  stripping, /api/status/cancel-all route, node tests for CancelConfirm;
  firewall _config_apply tests no longer write the real repo config
- docs: api.md, state-model.md, config.md, hoover.md

tests/test_api.py

@@ -997,4 +997,24 @@ class TestStatusRefresh:
         mock_post.side_effect = RuntimeError("no daemon")
         resp = status_client.post("/api/status/refresh", json={})
         assert resp.status_code == 500
+
+
+class TestStatusCancelAll:
+    @_st("post")
+    def test_success(self, mock_post, status_client):
+        from daemon.iface import POST_STATUS_CANCEL_ALL
+
+        mock_post.return_value = {"cancelled": ["dnsmasq"], "skipped": {}, "errors": {}}
+        resp = status_client.post("/api/status/cancel-all")
+        assert resp.status_code == 200
+        data = resp.get_json()
+        assert data["ok"] is True
+        assert data["data"] == {"cancelled": ["dnsmasq"], "skipped": {}, "errors": {}}
+        mock_post.assert_called_once_with(POST_STATUS_CANCEL_ALL)
+
+    @_st("post")
+    def test_runtime_error(self, mock_post, status_client):
+        mock_post.side_effect = RuntimeError("no daemon")
+        resp = status_client.post("/api/status/cancel-all")
+        assert resp.status_code == 500
         assert resp.get_json()["ok"] is False