Add changesets, bandwidth limits and quotas; generic examples

Changesets, as in Jarl: configuration changes are operations that can be
staged in a changeset, checked as they are added (validation and nft -c),
reviewed with the diff of the ruleset, and applied together as one
history entry, then on probation like any change made over the network.
The web UI collects edits for review by default (pending rows, a bar with
Review and Apply now, a Changes page, a switch for live edits); hc stages
with -C ID or HOUSECARL_CHANGESET (checked like JARL_CHANGESET) and has
hc changeset create/list/show/diff/apply/discard/remove. Undo, import and
takeover refuse a changeset. --dry-run shows the ruleset's diff.

Bandwidth and quotas: rate limits in bytes, per source or destination;
quotas per rule or per address that reset daily, weekly, monthly on a
day, or by hand, with their usage carried across reloads, saved for
reboots, shown by hc quotas and on the rules page, and reset with hc rule
reset-quota. Rules that count traffic are checked before established
connections are accepted (so they see every packet) and can't accept.
Per-address limits group IPv6 by /64 by default (--group-v4/-v6).
Per-source rate meters use update. The importer turns meters, byte rates
and quotas into these fields.

The examples in the web UI, hc's help and the docs use documentation
addresses and generic names instead of the maintainer's network.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/nat.md

@@ -8,9 +8,9 @@ One object does what takes three rules by hand (the DNAT, the forward
 accept, and the hairpin masquerade).
 
 ```sh
-hc forward add 8096 --to 10.0.10.57:443 --public 203.0.113.7 --hairpin --name jellyfin
-hc forward add 7777-7780 --proto tcp,udp --to 10.0.10.76 --public 203.0.113.7 --hairpin --name terraria
-hc forward add 25 --to 10.0.10.25 --from mail-relays --name smtp
+hc forward add 8443 --to 192.168.1.10:443 --public 203.0.113.10 --hairpin --name web
+hc forward add 27015-27030 --proto tcp,udp --to 192.168.1.20 --public 203.0.113.10 --hairpin --name game
+hc forward add 25 --to 192.168.1.25 --from mail-relays --name smtp
 hc forward list
 ```
 
@@ -44,10 +44,10 @@ IPv6 needs no translation: inside hosts have public addresses. `--to6`
 opens the same port (or the `--to` port, if given) to an IPv6 host:
 
 ```sh
-hc forward add 8096 --to 10.0.10.57:443 --to6 2001:db8:7f3d:10::57 --public 203.0.113.7 --name jellyfin
+hc forward add 8443 --to 192.168.1.10:443 --to6 2001:db8:1::10 --public 203.0.113.10 --name web
 ```
 
-IPv6 clients connect to `[2001:db8:7f3d:10::57]:443` directly. A forward
+IPv6 clients connect to `[2001:db8:1::10]:443` directly. A forward
 can have only `--to6`, to open an IPv6 port alone.
 
 ## Source NAT
@@ -60,7 +60,7 @@ service; the first that matches decides.
 ```sh
 hc snat add --out wan --from trusted --comment "the LAN to the internet"
 hc snat add --out wg0 --not-out --from wg-clients
-hc snat add --out wan --from fd00:abab::/48 --family ipv6 --snat-to 2001:db8:7f3d::1
+hc snat add --out wan --from fd00:1::/48 --family ipv6 --snat-to 2001:db8::1
 ```
 
 Source NAT is IPv4 only unless `--family ipv6` says otherwise: with a
@@ -73,7 +73,7 @@ A redirect sends matching traffic to a port on the firewall itself, for
 example to make every client use the firewall's DNS server:
 
 ```sh
-hc redirect add --in lan --service dns --not-to 10.0.10.5 --comment "force DNS"
+hc redirect add --in lan --service dns --not-to 192.168.1.5 --comment "force DNS"
 hc redirect add --in lan --service http --to-port 3128
 ```