Names beside inside addresses

Reverse lookups (internal/names, POST /names) put a name beside each
inside address in connections, the log, quota usage, the dashboard's
quotas and the statistics' devices and blocked sources, in the web UI
and hc (--no-names to leave them out). Only inside addresses are looked
up: an inside zone's networks, and private ones outside the external
zones'. Names are cached (names.cache, 10m) and never stored;
names.resolver picks the DNS server.

Also: hc stats top devices listed each device twice; the dashboard's
quotas named the rule's ID twice.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -8,6 +8,14 @@ All notable changes to Housecarl are documented here. The format follows
 
 ### Added
 
+- **Names beside inside addresses.** Connections, the log, quota usage,
+  the dashboard's quotas and the statistics' devices and blocked
+  sources show each inside address's name, found by a reverse lookup:
+  `laptop 192.168.1.20` in the web UI, `192.168.1.20 (laptop)` in `hc`.
+  Only inside addresses are looked up (an inside zone's networks, and
+  private ones outside the external zones'). Names are cached for 10
+  minutes and never stored. `names.enabled`, `names.resolver` and
+  `names.cache` in housecarl.yaml; `hc --no-names`; `POST /names`.
 - **Quotas on the dashboard.** With any rule holding a quota, the
   dashboard lists them all: the allowance, what is used (for a
   per-address quota, how many addresses and the busiest) with a bar, and
@@ -62,6 +70,8 @@ All notable changes to Housecarl are documented here. The format follows
 
 ### Fixed
 
+- `hc stats top devices` listed each device twice (once for what it
+  received, once for what it sent); it is one row with both again.
 - `hc rule add --before/--after/--first` made two changes (create at the
   end, then move), so two history entries, two probations, and the rule
   briefly in force at the end of its chain; staged in a changeset, the