Add update-vendor.sh symlink support, unify install.sh vendor flow

- update-vendor.sh now creates webui/vendor symlinks (htm.js)
- install.sh calls update-vendor.sh after package install
- Add vendor/.empty and webui/vendor/.empty as directory placeholders in git

lib/firewall.py

@@ -379,6 +379,37 @@ def config_pending(state: dict[str, Any]) -> dict[str, Any]:
     return _compute_pending_changes(cfg, live_zones)
 
 
+def fw_change_summary(zone: str, ctype: str, change: dict[str, Any]) -> str:
+    """Build a human-readable summary string for a firewall change."""
+    if ctype == "interfaces":
+        config_if = change.get("config", [])
+        live_if = change.get("live", [])
+        return f"Zone {zone}: interfaces changed (config: {config_if}, live: {live_if})"
+    if ctype == "services":
+        config_sv = change.get("config", [])
+        live_sv = change.get("live", [])
+        return f"Zone {zone}: services changed (config: {config_sv}, live: {live_sv})"
+    if ctype == "rich_rules":
+        cfg_count = change.get("config_count", 0)
+        live_count = change.get("live_count", 0)
+        return (
+            f"Zone {zone}: rich rules differ (config: {cfg_count}, live: {live_count})"
+        )
+    if ctype == "forward_ports":
+        cfg_count = change.get("config_count", 0)
+        live_count = change.get("live_count", 0)
+        return f"Zone {zone}: port forwards differ (config: {cfg_count}, live: {live_count})"
+    if ctype == "masquerade":
+        cfg_val = change.get("config", False)
+        live_val = change.get("live", False)
+        return f"Zone {zone}: masquerade changed (config: {cfg_val}, live: {live_val})"
+    if ctype == "target":
+        cfg_val = change.get("config", "default")
+        live_val = change.get("live", "default")
+        return f"Zone {zone}: target changed (config: {cfg_val}, live: {live_val})"
+    return f"Zone {zone}: {ctype} changed"
+
+
 __all__ = [
     "CONFIG_DIR",
     "CONFIG_FILE",
@@ -396,6 +427,7 @@ __all__ = [
     "_parse_interfaces",
     "_parse_zone_output",
     "config_pending",
+    "fw_change_summary",
     "get_config",
     "load_backup",
     "save_backup",