ui: amber pending-edit markers for unapplied config changes

Add hoover/dirty.js: line-matching helpers that flag UI rows/cards
edited (saved to config) but not yet applied, consuming the pending
state the daemon already streams — status.pending_diff for hash
subsystems, firewall pending zone+type for firewalld. Visual language
is amber (.config-dirty + PendingDot), distinct from the red
.pending-delete; orphanInfo surfaces removed entries (e.g. WireGuard
peers) on their container table. Wired into the backends, dhcp,
interfaces, nat, proxy, rules, wireguard, and zones pages; Card and
Table gain cls/title props. Covered by 27 node tests
(tests/test-dirty.js).

webui/static/style.css

@@ -1062,6 +1062,37 @@ body {
     color: var(--text-muted);
 }
 
+/* Pending (edited, not yet applied) marker — amber, distinct from the red
+   .pending-delete. Applied to rows/cards/sections whose config is dirty. */
+.config-dirty {
+    background: rgba(243, 156, 18, 0.07);
+}
+
+tr.config-dirty > td:first-child {
+    box-shadow: inset 3px 0 0 var(--warning);
+}
+
+/* A row queued for deletion (red) takes precedence over the dirty marker. */
+tr.pending-delete.config-dirty > td:first-child {
+    box-shadow: none;
+}
+
+.card.config-dirty,
+.backend-section.config-dirty,
+.domain-config.config-dirty {
+    box-shadow: inset 3px 0 0 var(--warning);
+}
+
+.pending-dot {
+    display: inline-block;
+    width: 7px;
+    height: 7px;
+    border-radius: 50%;
+    background: var(--warning);
+    margin-right: 6px;
+    vertical-align: middle;
+}
+
 /* Responsive */
 @media (max-width: 768px) {
     .sidebar {