Add declarative firewall config with save-then-apply workflow

New two-step config flow: POST /config saves desired state to
config/firewall/config.json, GET /config/pending diffs against live
firewalld state, POST /config/apply synchronizes live state.  Adds target
normalization helpers and full test coverage for config CRUD and pending
diff logic.

webui/server.py

@@ -15,7 +15,13 @@ from lib.acme import get_email, list_certs
 from lib.dnsmasq import get_config as dnsmasq_config
 from lib.dnsmasq import get_lease_table
 from lib.dnsmasq import get_status as dnsmasq_status
-from lib.firewall import get_active_zones, get_interfaces, get_zone_info
+from lib.firewall import (
+    config_get,
+    config_pending,
+    get_active_zones,
+    get_interfaces,
+    get_zone_info,
+)
 from lib.nginx import get_config as nginx_config
 from lib.nginx import get_domains
 from lib.wireguard import get_config as wg_config
@@ -155,26 +161,34 @@ def dashboard():
         certs=certs,
         wg_status=wg,
         services=_get_service_status(dnsmasq, wg),
+        firewall_config=_safely(config_get, {}),
+        firewall_pending=_safely(config_pending, {}),
     )
 
 
 @app.route("/interfaces")
 def interfaces_page():
+    firewall_config = _safely(config_get, {})
+    firewall_pending = _safely(config_pending, {})
     return render_template(
         "interfaces.html",
         interfaces=_safely(get_interfaces, []),
         active_zones=_safely(get_active_zones, {}),
+        firewall_config=firewall_config,
+        firewall_pending=firewall_pending,
     )
 
 
 @app.route("/zones")
 def zones_page():
-    zones = {}
+    firewall_config = _safely(config_get, {})
+    firewall_pending = _safely(config_pending, {})
+    zones_data = {}
     for name in _safely(get_active_zones, {}):
-        zones[name] = _safely(lambda n=name: get_zone_info(n), {})
+        zones_data[name] = _safely(lambda n=name: get_zone_info(n), {})
     return render_template(
         "zones.html",
-        zones=zones,
+        zones=zones_data,
         interfaces=_safely(get_interfaces, []),
         services=_safely(
             lambda: __import__(
@@ -182,6 +196,8 @@ def zones_page():
             ).get_services(),
             [],
         ),
+        firewall_config=firewall_config,
+        firewall_pending=firewall_pending,
     )