status: cancel-all reverts pending changes to last applied config

- lib.common.revert_to_applied(): restore a config file from its
  _last_applied_config snapshot (stamped hash); no baseline -> skip with
  reason, file untouched
- firewall config_apply now stamps the applied baseline like the other
  subsystems; GET /firewall/config and the state collector strip the
  internal _last_applied_* keys
- POST /status/cancel-all + /api/status/cancel-all: revert pending
  subsystems, {cancelled, skipped, errors}, partial-failure safe
- dashboard: "Cancel All Changes" button with confirm modal
  (CancelConfirm, reuses the pending-changes modal rows); the pending
  changes card is hidden entirely when nothing is pending
- tests: revert_to_applied, status_cancel_all, firewall stamping/meta
  stripping, /api/status/cancel-all route, node tests for CancelConfirm;
  firewall _config_apply tests no longer write the real repo config
- docs: api.md, state-model.md, config.md, hoover.md

webui/static/pages/dashboard.js

@@ -1,4 +1,4 @@
-import { html, PageHeader, definePage, getModel, renderGuardMulti, ServiceStatus, StatCard, Table, Badge, ActionButton, fmtBytes } from '/static/hoover/index.js';
+import { html, PageHeader, definePage, getModel, renderGuardMulti, ServiceStatus, StatCard, Table, Badge, ActionButton, CancelConfirm, fmtBytes } from '/static/hoover/index.js';
 
 // Render a single firewall change as "current → new".
 // `live` is the currently applied value; `config` is the target value it
@@ -144,7 +144,7 @@ export default definePage({
                 meta=${expiringCerts.length ? expiringCerts.length + ' expiring' : 'All valid'} />
         </div>`;
 
-        // ── Pending changes ──
+        // ── Pending changes (hidden entirely when nothing is pending) ──
         const pendingCard = pendingBlocks.length > 0
             ? html`<div class="card">
                 <div class="card-header">Pending Changes <span style="margin-left:8px"><${Badge} text=${String(totalChanges)} variant="warning" /></span></div>
@@ -157,15 +157,15 @@ export default definePage({
                             </ul>
                         </li>`)}
                     </ul>
-                    <${ActionButton} url="/api/status/apply-all" label="Apply All Changes"
-                        successMsg="All changes applied"
-                        cls="btn btn-sm btn-primary" />
+                    <div style="display:flex;gap:8px;flex-wrap:wrap">
+                        <${ActionButton} url="/api/status/apply-all" label="Apply All Changes"
+                            successMsg="All changes applied"
+                            cls="btn btn-sm btn-primary" />
+                        <${CancelConfirm} cls="btn btn-sm btn-danger" />
+                    </div>
                 </div>
             </div>`
-            : html`<div class="card">
-                <div class="card-header">Pending Changes</div>
-                <div class="card-body"><${Badge} text="All configured" variant="success" /></div>
-            </div>`;
+            : null;
 
         // ── System resources ──
         const memPct = sysMem.used_pct || 0;