refactor: introduce model layer for centralized data synchronization

Add hoover model.js as a central reactive store per subsystem, replacing
per-component data fetching with a single source of truth.

- Add hoover/model.js with modelRegister, modelFetch, and WS invalidation
- Refactor websocket.js to route messages to model refresh (drop per-component
  subscribe/unsubscribe)
- Simplify component.js by removing WS subscription management
- Add refresh option to apiSubmit, deprecate refactorLoad and checkAbort
- Rewrite all pages to use getModel() instead of inline data fetching
- Bootstrap model registrations in app.js
- Add GET /api/firewall/state endpoint
- Fix restart-services.sh restart order and add service health verification
- Update hoover.md docs with model layer architecture

restart-services.sh

@@ -1,10 +1,21 @@
 #!/bin/bash
 
 systemctl restart nginx
-systemctl restart vacuum-wall
+sleep 1
 systemctl restart vacuum-walld
+sleep 1
+systemctl restart vacuum-wall
 
-systemctl status nginx
-systemctl status vacuum-wall
-systemctl status vacuum-walld
+# Verify services are running
+failed=0
+for svc in nginx vacuum-walld vacuum-wall; do
+  if ! systemctl is-active --quiet "$svc"; then
+    echo "ERROR: $svc is not running" >&2
+    failed=1
+  fi
+done
+
+if [ "$failed" -eq 1 ]; then
+  exit 1
+fi