Add changesets, bandwidth limits and quotas; generic examples

Changesets, as in Jarl: configuration changes are operations that can be
staged in a changeset, checked as they are added (validation and nft -c),
reviewed with the diff of the ruleset, and applied together as one
history entry, then on probation like any change made over the network.
The web UI collects edits for review by default (pending rows, a bar with
Review and Apply now, a Changes page, a switch for live edits); hc stages
with -C ID or HOUSECARL_CHANGESET (checked like JARL_CHANGESET) and has
hc changeset create/list/show/diff/apply/discard/remove. Undo, import and
takeover refuse a changeset. --dry-run shows the ruleset's diff.

Bandwidth and quotas: rate limits in bytes, per source or destination;
quotas per rule or per address that reset daily, weekly, monthly on a
day, or by hand, with their usage carried across reloads, saved for
reboots, shown by hc quotas and on the rules page, and reset with hc rule
reset-quota. Rules that count traffic are checked before established
connections are accepted (so they see every packet) and can't accept.
Per-address limits group IPv6 by /64 by default (--group-v4/-v6).
Per-source rate meters use update. The importer turns meters, byte rates
and quotas into these fields.

The examples in the web UI, hc's help and the docs use documentation
addresses and generic names instead of the maintainer's network.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/import.md

@@ -19,7 +19,7 @@ services, rules, port forwards and NAT, then **notes** on every guess it
 made, and the rules it **kept raw**.
 
 `--defines` reads your ruleset file's `define` lines, so sets get your
-names (`define trusted_ips = { ... }` becomes the set `trusted_ips`).
+names (`define admins = { ... }` becomes the set `admins`).
 Without it, sets are named after what they hold. Interfaces named by a
 define name their zone too (`define wan_interface = "ppp0"` makes the
 zone `wan`); otherwise a zone is named after its interface.
@@ -68,6 +68,13 @@ Import a ruleset.
   one is left out with a note, to be added by hand.
 * **Masquerade and SNAT** become source NAT; **redirect** becomes a
   redirect.
+* **Meters** (`update @m { ip saddr limit rate over 3/minute }`,
+  `add @m { ip saddr ct count over 20 }`, quotas in sets) become the
+  rule's per-source (or per-destination) limit, connection limit or quota;
+  a mask in the key (`ip saddr and 255.255.255.0`) becomes its grouping.
+  Byte rates and quotas are imported too; a quota imported resets only by
+  hand until you give it a period. A rule with a quota or a byte rate that
+  accepts stays a raw rule ([rules.md](rules.md#bandwidth-and-quotas)).
 * **Policies** become the chains' policies.
 * **Anything else** becomes a raw rule with its original text, in place.
   A raw rule naming a set of the old table needs the new set name: