firewall: interface-coverage apply guard, target drift, non-destructive DHCP sync

Post-DHCP-incident hardening per HARDEN.md.

- apply guard: refuse (ConflictError, `force` overrides) when a
  network-managed interface would end up in no zone; absent
  `interfaces` key = hands-off, explicit `[]` = unassign-all
- surface `uncovered_interfaces` in firewall state (lo/wg* filtered)
  + advisory in /api/status/pending; zones.js banner + interfaces-picker
  last-zone confirm
- target drift (Option A): absent or default-normalizing target is
  unmanaged: not diffed, never re-set by apply; create_zone runs
  --new-zone first and sets non-default targets only; importer omits
  the target key for default zones
- FirewallToDhcpSync keeps stale DHCP ranges and flags them instead of
  deleting; `dnsmasq` affected only on a real gateway mutation
- real pre-apply recovery snapshot in data/firewall/rules.json
  ({timestamp, default_zone, zones, config}); drop the empty post-apply
  skeleton
- daemon shutdown: bounded grace for in-flight tasks + suppressed
  teardown exception noise on SIGTERM
- also carries the firewall service-descriptions feature
  (get_service_descriptions + service_descriptions state field + UI)
- tests + docs across firewall/status/state/sync/schema; ruff clean,
  867 passing

lib/schema.py

@@ -94,6 +94,10 @@ class FirewallState(TypedDict):
             catch-all zone for interfaces with no explicit assignment.
         interfaces: All system interfaces (see FirewallInterface).
         available_services: firewalld service catalog ("--get-services").
+        service_descriptions: Service name to one-line description, parsed
+            from the firewalld service XML definitions
+            (``lib.firewall.get_service_descriptions``).
+        uncovered_interfaces: Network-config interfaces (excluding ``lo``/``wg*``) not in any live zone (advisory coverage warning, always present).
         zones: All zones as runtime dicts (see FirewallZone).
         rich_rules: Zone name → raw firewalld rich-rule strings.
         pending: config_pending() result:
@@ -107,6 +111,8 @@ class FirewallState(TypedDict):
     default_zone: str
     interfaces: list[FirewallInterface]
     available_services: list[str]
+    service_descriptions: dict[str, str]
+    uncovered_interfaces: list[str]
     zones: dict[str, FirewallZone]
     rich_rules: dict[str, list[str]]
     pending: dict[str, Any]