refactor: introduce model layer for centralized data synchronization

Add hoover model.js as a central reactive store per subsystem, replacing
per-component data fetching with a single source of truth.

- Add hoover/model.js with modelRegister, modelFetch, and WS invalidation
- Refactor websocket.js to route messages to model refresh (drop per-component
  subscribe/unsubscribe)
- Simplify component.js by removing WS subscription management
- Add refresh option to apiSubmit, deprecate refactorLoad and checkAbort
- Rewrite all pages to use getModel() instead of inline data fetching
- Bootstrap model registrations in app.js
- Add GET /api/firewall/state endpoint
- Fix restart-services.sh restart order and add service health verification
- Update hoover.md docs with model layer architecture

webui/api/firewall.py

@@ -17,6 +17,7 @@ from daemon.iface import (
     GET_FIREWALL_INTERFACES,
     GET_FIREWALL_RICH_RULES,
     GET_FIREWALL_SERVICES,
+    GET_FIREWALL_STATE,
     GET_FIREWALL_ZONES,
     GET_FIREWALL_ZONES_INFO,
     PATCH_FIREWALL_CONFIG,
@@ -194,6 +195,28 @@ def config_pending_bp():
         return _error(str(exc), 500)
 
 
+# ---------------------------------------------------------------------------
+# State
+# ---------------------------------------------------------------------------
+
+
+@bp.route("/state", methods=["GET"])
+def get_state():
+    """Retrieve current firewall state from the state store.
+
+    Endpoint:
+        GET /api/firewall/state
+
+    Returns:
+        JSON with firewall state data or an error message.
+    """
+    try:
+        return _ok(get(GET_FIREWALL_STATE))
+    except RuntimeError as exc:
+        logger.error("Failed to get firewall state: %s", exc)
+        return _error(str(exc), 500)
+
+
 # ---------------------------------------------------------------------------
 # Zones
 # ---------------------------------------------------------------------------