Add changesets, bandwidth limits and quotas; generic examples

Changesets, as in Jarl: configuration changes are operations that can be
staged in a changeset, checked as they are added (validation and nft -c),
reviewed with the diff of the ruleset, and applied together as one
history entry, then on probation like any change made over the network.
The web UI collects edits for review by default (pending rows, a bar with
Review and Apply now, a Changes page, a switch for live edits); hc stages
with -C ID or HOUSECARL_CHANGESET (checked like JARL_CHANGESET) and has
hc changeset create/list/show/diff/apply/discard/remove. Undo, import and
takeover refuse a changeset. --dry-run shows the ruleset's diff.

Bandwidth and quotas: rate limits in bytes, per source or destination;
quotas per rule or per address that reset daily, weekly, monthly on a
day, or by hand, with their usage carried across reloads, saved for
reboots, shown by hc quotas and on the rules page, and reset with hc rule
reset-quota. Rules that count traffic are checked before established
connections are accepted (so they see every packet) and can't accept.
Per-address limits group IPv6 by /64 by default (--group-v4/-v6).
Per-source rate meters use update. The importer turns meters, byte rates
and quotas into these fields.

The examples in the web UI, hc's help and the docs use documentation
addresses and generic names instead of the maintainer's network.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/design.md

@@ -50,6 +50,34 @@ Every change goes through one engine (`internal/engine`):
 Dry runs, history with undo, users, sessions and scoped API tokens come
 from the same machinery as in Jarl and Steward.
 
+## Reviewing changes: changesets
+
+As in Jarl, a change can be made at once or staged in a **changeset**,
+to be reviewed and applied together with others:
+
+* Each change is an **operation** (create, update, delete or move an
+  object, or change the settings), kept as the API received it.
+* Staged in a changeset, an operation is checked as it is added: the
+  changeset with it must still be valid, and nftables must accept the
+  ruleset it makes. Nothing is applied.
+* The **review** shows the operations, the problems, and the **diff of
+  the ruleset**: the file that is loaded at boot, now and after.
+* **Applying** replays the operations on the configuration as it is then,
+  as one change: one check, one transaction, one history entry, undone as
+  a whole. An operation that no longer applies (its object was changed or
+  deleted since) is named, and can be taken out.
+* Then the applied changeset is **on probation** like any change made over
+  the network: unless it is confirmed, it is rolled back.
+
+| Interface | Default | Why |
+|---|---|---|
+| Web UI | Review edits: they are collected in a draft changeset, pages show pending rows (green new, yellow changed, struck out deleted), and a bar leads to the Changes page, with the diff and Apply. The switch in the header turns on Live edits, applied at once. | Several related edits, seen together before they are in force. |
+| CLI | Immediate: each command is a change of its own. Stage with `-C ID` or `HOUSECARL_CHANGESET`. | Scripts want a clear result per step. |
+| API | Immediate unless a changeset is named (`?changeset=ID`, `X-Housecarl-Changeset`). | As the CLI. |
+
+Undo, imports and takeovers can't be staged; with a changeset named, they
+are refused rather than applied.
+
 ## Its own table only
 
 Housecarl writes one table, `inet housecarl`, and leaves every other
@@ -73,7 +101,8 @@ and log lines are traced back to their object through it.
 
 ## Not locking yourself out
 
-A change made over the network is applied **on probation**: unless it is
+A change made over the network is applied **on probation** (a changeset
+when it is applied, a live edit at once): unless it is
 confirmed within two minutes (Settings; `hc confirm`, the banner in the
 web UI, `POST /confirm`), it is rolled back by itself, and the rollback is
 recorded in the history. A change that cuts you off undoes itself.