Add changesets, bandwidth limits and quotas; generic examples

Changesets, as in Jarl: configuration changes are operations that can be
staged in a changeset, checked as they are added (validation and nft -c),
reviewed with the diff of the ruleset, and applied together as one
history entry, then on probation like any change made over the network.
The web UI collects edits for review by default (pending rows, a bar with
Review and Apply now, a Changes page, a switch for live edits); hc stages
with -C ID or HOUSECARL_CHANGESET (checked like JARL_CHANGESET) and has
hc changeset create/list/show/diff/apply/discard/remove. Undo, import and
takeover refuse a changeset. --dry-run shows the ruleset's diff.

Bandwidth and quotas: rate limits in bytes, per source or destination;
quotas per rule or per address that reset daily, weekly, monthly on a
day, or by hand, with their usage carried across reloads, saved for
reboots, shown by hc quotas and on the rules page, and reset with hc rule
reset-quota. Rules that count traffic are checked before established
connections are accepted (so they see every packet) and can't accept.
Per-address limits group IPv6 by /64 by default (--group-v4/-v6).
Per-source rate meters use update. The importer turns meters, byte rates
and quotas into these fields.

The examples in the web UI, hc's help and the docs use documentation
addresses and generic names instead of the maintainer's network.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -30,6 +30,25 @@ the way Jarl and Steward are.
   invalid packets, ICMPv6 (RFC 4890), ping from internal zones, DHCPv6
   client replies, antispoofing with your own prefixes, MSS clamping, and
   a flowtable fast path.
+- **Changesets, as in Jarl:** changes staged to be reviewed and applied
+  together, as one history entry. Each is checked as it is staged; the
+  review shows the problems, nftables' check and the diff of the ruleset.
+  The web UI collects edits as pending changes by default (pending rows,
+  a bar with Review and Apply now, a Changes page), with a switch for live
+  edits; hc stages with `-C ID` or `HOUSECARL_CHANGESET`, and has `hc
+  changeset create/list/show/diff/apply/discard/remove`. An applied
+  changeset is on probation like any change. `--dry-run` shows the
+  ruleset's diff too (docs/design.md, docs/cli.md).
+- **Bandwidth limits and quotas:** rate limits in bytes (`--limit
+  20mbytes/second,over,per-source`), per source or per destination;
+  quotas, an allowance of traffic per rule or per address, reset daily,
+  weekly, monthly on a chosen day, or by hand, kept across changes,
+  restarts and reboots (`hc quotas`, `hc rule reset-quota`, usage on the
+  rules page). Rules that count traffic are checked before established
+  connections are accepted, so they see every packet. Per-address limits
+  group IPv6 by /64 by default (`--group-v4`, `--group-v6`). Meters,
+  byte rates and quotas in an imported ruleset carry over
+  (docs/rules.md).
 - **Changes checked twice and applied atomically:** validation of the
   whole configuration with stable problem codes (docs/validation.md),
   then `nft -c`, then one `nft -f` transaction that replaces Housecarl's