Quotas: carry what was used when a rule counts differently

model.QuotaCarry says what becomes of a quota's use when its rule
changes how it counts; the firewall's apply follows it, comparing with
the rules in force: per address to a total starts at the addresses' sum,
wider groups add up their addresses, and what can't be carried (a total
to per address, per source to per destination, finer groups) starts
again, with the engine warning quota_restarts on that change. Before,
per source to per destination kept the sources' use as destinations',
and regrouping left old entries behind.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -342,6 +342,15 @@ run "the device is back" 0 send 1000
 run "the reset is audited" 0 H audit --action quota.
 contains "quota.reset"
 contains "quota.give"
+# Counted in total now: what the device used carries over; per
+# destination can't take it, and says so.
+run "within the quota" 0 send 300000
+run "to one total" 0 H rule update "$QR" --quota 1mbytes,over
+not_contains "quota_restarts"
+run "the total carried over" 0 H quotas
+contains "e2e quota)  *[0-9.]* KB"
+run "per destination starts again" 0 H rule update "$QR" --quota 1mbytes,over,per-destination
+contains "quota_restarts"
 run "the quota rule goes" 0 H rule delete -y "$QR"
 
 # ---- the zone matrix, of the imported ruleset