Add changesets, bandwidth limits and quotas; generic examples

Changesets, as in Jarl: configuration changes are operations that can be
staged in a changeset, checked as they are added (validation and nft -c),
reviewed with the diff of the ruleset, and applied together as one
history entry, then on probation like any change made over the network.
The web UI collects edits for review by default (pending rows, a bar with
Review and Apply now, a Changes page, a switch for live edits); hc stages
with -C ID or HOUSECARL_CHANGESET (checked like JARL_CHANGESET) and has
hc changeset create/list/show/diff/apply/discard/remove. Undo, import and
takeover refuse a changeset. --dry-run shows the ruleset's diff.

Bandwidth and quotas: rate limits in bytes, per source or destination;
quotas per rule or per address that reset daily, weekly, monthly on a
day, or by hand, with their usage carried across reloads, saved for
reboots, shown by hc quotas and on the rules page, and reset with hc rule
reset-quota. Rules that count traffic are checked before established
connections are accepted (so they see every packet) and can't accept.
Per-address limits group IPv6 by /64 by default (--group-v4/-v6).
Per-source rate meters use update. The importer turns meters, byte rates
and quotas into these fields.

The examples in the web UI, hc's help and the docs use documentation
addresses and generic names instead of the maintainer's network.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/operations.md

@@ -17,6 +17,14 @@ housecarld logs each change it applies, rollbacks, and what it couldn't
 apply. When it starts, it applies the configuration again (rolling back
 first what was on probation when it stopped).
 
+## Reviewing before applying
+
+In the web UI, edits are collected as pending changes (the bar under the
+header), and Changes shows them with the diff of the ruleset; Apply puts
+them in force together. The switch in the header (Review edits / Live
+edits) applies each edit at once instead. With hc, see
+[cli.md](cli.md#changesets).
+
 ## Changes on probation
 
 Changes made over the network roll back unless confirmed
@@ -66,6 +74,15 @@ Every rule, NAT rule, built-in and policy has a counter. `hc rule list`,
 all, with bytes. They count from housecarld's start, and carry across
 changes to the ruleset.
 
+## Quotas
+
+`hc quotas` (and the rules page) show what each quota used and when it
+resets; `hc rule reset-quota ID` starts one again. housecarld resets
+quotas at midnight when their period ends (late, if it was stopped then),
+and saves their usage every five minutes and when it stops; after a
+reboot it puts it back. A reboot without a clean stop loses at most the
+last five minutes' count.
+
 ## The log
 
 Rules with `--log` (Log in the web UI) and, with `hc settings set
@@ -78,8 +95,8 @@ hc log --search 198.51.100.7
 ```
 
 ```
-10:02:13  hc input #95 drop:     wan  -   198.51.100.7:53868 -> 203.0.113.7:22   tcp syn
-10:02:15  hc forward policy drop: wan  enp2s0  198.51.100.9:443 -> 10.0.10.20:51432  tcp
+10:02:13  hc input #95 drop:     wan  -   198.51.100.7:53868 -> 203.0.113.10:22   tcp syn
+10:02:15  hc forward policy drop: wan  eth1  198.51.100.9:443 -> 192.168.1.20:51432  tcp
 ```
 
 The packets go to netlink log group 4171, where housecarld reads them;