Add declarative firewall config with save-then-apply workflow

New two-step config flow: POST /config saves desired state to
config/firewall/config.json, GET /config/pending diffs against live
firewalld state, POST /config/apply synchronizes live state.  Adds target
normalization helpers and full test coverage for config CRUD and pending
diff logic.

webui/api/firewall.py

@@ -9,6 +9,9 @@ from flask import Blueprint, jsonify, request
 from lib.firewall import (
     add_forward_port,
     add_rich_rule,
+    config_get,
+    config_pending,
+    config_set,
     create_zone,
     delete_zone,
     get_active_zones,
@@ -40,6 +43,60 @@ def _ok(data=None):
     return jsonify({"ok": True, "data": data})
 
 
+# ---------------------------------------------------------------------------
+# Declarative config (two-step: save -> apply)
+# ---------------------------------------------------------------------------
+
+
+@bp.route("/config", methods=["GET"])
+def config_get_bp():
+    try:
+        return _ok(config_get())
+    except Exception as exc:
+        return _error(str(exc), 500)
+
+
+@bp.route("/config", methods=["POST"])
+def config_set_bp():
+    body = request.get_json(silent=True) or {}
+    if "zones" not in body:
+        return _error("'zones' key is required", 400)
+    if not isinstance(body["zones"], dict):
+        return _error("'zones' must be a dict", 400)
+    try:
+        config_set(body)
+        pending_info = config_pending()
+        return _ok(
+            {
+                "config_saved": True,
+                "pending": pending_info["pending"],
+                "needs_apply": pending_info["needs_apply"],
+                "unmanaged_zones": pending_info.get("unmanaged_zones", {}),
+            }
+        )
+    except Exception as exc:
+        return _error(str(exc), 500)
+
+
+@bp.route("/config/apply", methods=["POST"])
+def config_apply_bp():
+    try:
+        from lib.firewall import config_apply as _config_apply
+
+        result = _config_apply()
+        return _ok(result)
+    except Exception as exc:
+        return _error(str(exc), 500)
+
+
+@bp.route("/config/pending", methods=["GET"])
+def config_pending_bp():
+    try:
+        return _ok(config_pending())
+    except Exception as exc:
+        return _error(str(exc), 500)
+
+
 # ---------------------------------------------------------------------------
 # Zones
 # ---------------------------------------------------------------------------

webui/server.py

@@ -15,7 +15,13 @@ from lib.acme import get_email, list_certs
 from lib.dnsmasq import get_config as dnsmasq_config
 from lib.dnsmasq import get_lease_table
 from lib.dnsmasq import get_status as dnsmasq_status
-from lib.firewall import get_active_zones, get_interfaces, get_zone_info
+from lib.firewall import (
+    config_get,
+    config_pending,
+    get_active_zones,
+    get_interfaces,
+    get_zone_info,
+)
 from lib.nginx import get_config as nginx_config
 from lib.nginx import get_domains
 from lib.wireguard import get_config as wg_config
@@ -155,26 +161,34 @@ def dashboard():
         certs=certs,
         wg_status=wg,
         services=_get_service_status(dnsmasq, wg),
+        firewall_config=_safely(config_get, {}),
+        firewall_pending=_safely(config_pending, {}),
     )
 
 
 @app.route("/interfaces")
 def interfaces_page():
+    firewall_config = _safely(config_get, {})
+    firewall_pending = _safely(config_pending, {})
     return render_template(
         "interfaces.html",
         interfaces=_safely(get_interfaces, []),
         active_zones=_safely(get_active_zones, {}),
+        firewall_config=firewall_config,
+        firewall_pending=firewall_pending,
     )
 
 
 @app.route("/zones")
 def zones_page():
-    zones = {}
+    firewall_config = _safely(config_get, {})
+    firewall_pending = _safely(config_pending, {})
+    zones_data = {}
     for name in _safely(get_active_zones, {}):
-        zones[name] = _safely(lambda n=name: get_zone_info(n), {})
+        zones_data[name] = _safely(lambda n=name: get_zone_info(n), {})
     return render_template(
         "zones.html",
-        zones=zones,
+        zones=zones_data,
         interfaces=_safely(get_interfaces, []),
         services=_safely(
             lambda: __import__(
@@ -182,6 +196,8 @@ def zones_page():
             ).get_services(),
             [],
         ),
+        firewall_config=firewall_config,
+        firewall_pending=firewall_pending,
     )