Add changesets, bandwidth limits and quotas; generic examples

Changesets, as in Jarl: configuration changes are operations that can be
staged in a changeset, checked as they are added (validation and nft -c),
reviewed with the diff of the ruleset, and applied together as one
history entry, then on probation like any change made over the network.
The web UI collects edits for review by default (pending rows, a bar with
Review and Apply now, a Changes page, a switch for live edits); hc stages
with -C ID or HOUSECARL_CHANGESET (checked like JARL_CHANGESET) and has
hc changeset create/list/show/diff/apply/discard/remove. Undo, import and
takeover refuse a changeset. --dry-run shows the ruleset's diff.

Bandwidth and quotas: rate limits in bytes, per source or destination;
quotas per rule or per address that reset daily, weekly, monthly on a
day, or by hand, with their usage carried across reloads, saved for
reboots, shown by hc quotas and on the rules page, and reset with hc rule
reset-quota. Rules that count traffic are checked before established
connections are accepted (so they see every packet) and can't accept.
Per-address limits group IPv6 by /64 by default (--group-v4/-v6).
Per-source rate meters use update. The importer turns meters, byte rates
and quotas into these fields.

The examples in the web UI, hc's help and the docs use documentation
addresses and generic names instead of the maintainer's network.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -21,11 +21,14 @@ table of its own.
 
 * **Zones, sets and services, then rules.** Name your interfaces (`wan`,
   `lan`, `wg`), your addresses (`trusted`, IPv4 and IPv6 in one set) and
-  your ports (`jellyfin`, or the built-in `ssh`, `dns`, `https`…), and
+  your ports (`web`, or the built-in `ssh`, `dns`, `https`…), and
   write ordered rules with them: in, out or through the firewall, by
   zone, address, service, connection state, time of day, rate per
   source, or connection count. Anything else can be written as an
   nftables rule by hand.
+* **Bandwidth and quotas.** Byte-rate limits per device, and traffic
+  allowances that reset daily, weekly or monthly (or by hand), counted
+  across changes and reboots.
 * **IPv4 and IPv6 together.** One rule covers both; Housecarl writes the
   nftables rules each family needs.
 * **NAT in one object.** A port forward is the DNAT, the forward accept
@@ -36,7 +39,9 @@ table of its own.
   IPv6 needs, antispoofing for your prefixes, MSS clamping for PPPoE, the
   DHCPv6 client, and a flowtable fast path.
 * **Changes you can trust.** Each change is validated as a whole, checked
-  by nftables itself, and applied in one transaction. A change made over
+  by nftables itself, and applied in one transaction. As in Jarl, edits
+  can be collected in a changeset, reviewed with the diff of the ruleset,
+  and applied (or discarded) together. A change made over
   the network is on probation: unless you confirm it within two minutes,
   it rolls itself back, so a rule that cuts you off undoes itself.
 * **Your existing ruleset, imported.** `hc import` turns an nftables
@@ -75,10 +80,10 @@ sudo hc takeover "inet main"
 sudo systemctl disable nftables.service
 
 # ...or start from scratch: let yourself in first
-sudo hc set add admins 10.0.10.0/24
+sudo hc set add admins 192.168.1.0/24
 sudo hc rule add input --from admins --service ssh
 sudo hc zone add wan --interface ppp0 --external
-sudo hc zone add lan --interface enp2s0
+sudo hc zone add lan --interface eth1
 sudo hc rule add forward --in lan --out wan
 sudo hc snat add --out wan
 sudo hc status