firewall: interface-coverage apply guard, target drift, non-destructive DHCP sync

Post-DHCP-incident hardening per HARDEN.md.

- apply guard: refuse (ConflictError, `force` overrides) when a
  network-managed interface would end up in no zone; absent
  `interfaces` key = hands-off, explicit `[]` = unassign-all
- surface `uncovered_interfaces` in firewall state (lo/wg* filtered)
  + advisory in /api/status/pending; zones.js banner + interfaces-picker
  last-zone confirm
- target drift (Option A): absent or default-normalizing target is
  unmanaged: not diffed, never re-set by apply; create_zone runs
  --new-zone first and sets non-default targets only; importer omits
  the target key for default zones
- FirewallToDhcpSync keeps stale DHCP ranges and flags them instead of
  deleting; `dnsmasq` affected only on a real gateway mutation
- real pre-apply recovery snapshot in data/firewall/rules.json
  ({timestamp, default_zone, zones, config}); drop the empty post-apply
  skeleton
- daemon shutdown: bounded grace for in-flight tasks + suppressed
  teardown exception noise on SIGTERM
- also carries the firewall service-descriptions feature
  (get_service_descriptions + service_descriptions state field + UI)
- tests + docs across firewall/status/state/sync/schema; ruff clean,
  867 passing

tests/test_system_import.py

@@ -552,7 +552,9 @@ class TestImportFirewall:
         assert "zones" in cfg
         assert "public" in cfg["zones"]
         assert "internal" in cfg["zones"]
-        assert cfg["zones"]["public"]["target"] == "DEFAULT"
+        # Live target normalizes to "default" -> the target key is omitted
+        # (key-absence is the canonical "unmanaged" notation, WI-2).
+        assert "target" not in cfg["zones"]["public"]
         assert cfg["zones"]["public"]["interfaces"] == ["eth0", "eth1"]
         assert cfg["zones"]["public"]["services"] == [
             "dhcpv6-cidr",
@@ -560,9 +562,31 @@ class TestImportFirewall:
             "mdns",
             "ssh",
         ]
-        assert cfg["zones"]["internal"]["target"] == "DEFAULT"
+        assert "target" not in cfg["zones"]["internal"]
         assert cfg["zones"]["internal"]["interfaces"] == ["eth2"]
 
+    def test_import_keeps_nondefault_target(self, temp_project, tmp_path):
+        # A zone with interfaces and a non-default live target keeps its
+        # explicit target key (ACCEPT/DROP/REJECT remain fully managed).
+        output = (
+            "trusted (active)\n"
+            "  target: ACCEPT\n"
+            "  interfaces: eth3\n"
+            "  sources: \n"
+            "  services: \n"
+            "  ports: \n"
+            "  protocols: \n"
+            "  forward-ports: \n"
+            "  source-ports: \n"
+            "  icmp-blocks: \n"
+            "  rich rules: \n"
+        )
+        with patch("lib.system_import.run", return_value=output):
+            assert system_import.import_firewall()
+        cfg = self._read_json(tmp_path)
+        assert cfg["zones"]["trusted"]["target"] == "ACCEPT"
+        assert cfg["zones"]["trusted"]["interfaces"] == ["eth3"]
+
     def test_empty_interface_zones_skipped(self, temp_project, tmp_path):
         with patch("lib.system_import.run", return_value=FIREWALL_ZONES_OUTPUT):
             assert system_import.import_firewall()