Add declarative firewall config with save-then-apply workflow

New two-step config flow: POST /config saves desired state to
config/firewall/config.json, GET /config/pending diffs against live
firewalld state, POST /config/apply synchronizes live state.  Adds target
normalization helpers and full test coverage for config CRUD and pending
diff logic.

webui/api/firewall.py

@@ -9,6 +9,9 @@ from flask import Blueprint, jsonify, request
 from lib.firewall import (
     add_forward_port,
     add_rich_rule,
+    config_get,
+    config_pending,
+    config_set,
     create_zone,
     delete_zone,
     get_active_zones,
@@ -40,6 +43,60 @@ def _ok(data=None):
     return jsonify({"ok": True, "data": data})
 
 
+# ---------------------------------------------------------------------------
+# Declarative config (two-step: save -> apply)
+# ---------------------------------------------------------------------------
+
+
+@bp.route("/config", methods=["GET"])
+def config_get_bp():
+    try:
+        return _ok(config_get())
+    except Exception as exc:
+        return _error(str(exc), 500)
+
+
+@bp.route("/config", methods=["POST"])
+def config_set_bp():
+    body = request.get_json(silent=True) or {}
+    if "zones" not in body:
+        return _error("'zones' key is required", 400)
+    if not isinstance(body["zones"], dict):
+        return _error("'zones' must be a dict", 400)
+    try:
+        config_set(body)
+        pending_info = config_pending()
+        return _ok(
+            {
+                "config_saved": True,
+                "pending": pending_info["pending"],
+                "needs_apply": pending_info["needs_apply"],
+                "unmanaged_zones": pending_info.get("unmanaged_zones", {}),
+            }
+        )
+    except Exception as exc:
+        return _error(str(exc), 500)
+
+
+@bp.route("/config/apply", methods=["POST"])
+def config_apply_bp():
+    try:
+        from lib.firewall import config_apply as _config_apply
+
+        result = _config_apply()
+        return _ok(result)
+    except Exception as exc:
+        return _error(str(exc), 500)
+
+
+@bp.route("/config/pending", methods=["GET"])
+def config_pending_bp():
+    try:
+        return _ok(config_pending())
+    except Exception as exc:
+        return _error(str(exc), 500)
+
+
 # ---------------------------------------------------------------------------
 # Zones
 # ---------------------------------------------------------------------------