status: cancel-all reverts pending changes to last applied config

- lib.common.revert_to_applied(): restore a config file from its
  _last_applied_config snapshot (stamped hash); no baseline -> skip with
  reason, file untouched
- firewall config_apply now stamps the applied baseline like the other
  subsystems; GET /firewall/config and the state collector strip the
  internal _last_applied_* keys
- POST /status/cancel-all + /api/status/cancel-all: revert pending
  subsystems, {cancelled, skipped, errors}, partial-failure safe
- dashboard: "Cancel All Changes" button with confirm modal
  (CancelConfirm, reuses the pending-changes modal rows); the pending
  changes card is hidden entirely when nothing is pending
- tests: revert_to_applied, status_cancel_all, firewall stamping/meta
  stripping, /api/status/cancel-all route, node tests for CancelConfirm;
  firewall _config_apply tests no longer write the real repo config
- docs: api.md, state-model.md, config.md, hoover.md

webui/api/status.py

@@ -14,6 +14,7 @@ from daemon.iface import (
     GET_STATUS_PENDING,
     GET_SYSTEM_METRICS,
     POST_STATUS_APPLY_ALL,
+    POST_STATUS_CANCEL_ALL,
     POST_STATUS_REFRESH,
 )
 from webui.api.common import _error, _ok
@@ -56,6 +57,24 @@ def apply_all():
         return _error(str(exc), 500)
 
 
+@bp.route("/cancel-all", methods=["POST"])
+def cancel_all():
+    """Revert pending changes for all subsystems to the last applied config.
+
+    Endpoint:
+        POST /api/status/cancel-all
+
+    Returns:
+        JSON response with the reverted subsystems, skipped subsystems
+        (label -> reason), and any errors encountered.
+    """
+    try:
+        return _ok(post(POST_STATUS_CANCEL_ALL))
+    except RuntimeError as exc:
+        logger.error("Failed to cancel all pending changes: %s", exc)
+        return _error(str(exc), 500)
+
+
 @bp.route("/refresh", methods=["POST"])
 def refresh():
     """Re-collect state from the daemon, optionally filtered by subsystem.