Staged undo, built-ins window, machine warnings; raw and dynamic set fixes

- Undo is staged like any edit: in review mode the web UI's Undo, and hc
  history undo with -C or HOUSECARL_CHANGESET, add a revert operation
  that checks, when replayed, that nothing it touches changed since;
  applied, History links the entries. Imports and takeovers still can't
  be staged.
- The rules page sums up a chain's built-ins in one line; a window lists
  them with what they do and their hits, and switches them.
- Warnings about the machine (dashboard, hc status): nftables.service
  enabled (it loads /etc/nftables.conf at boot and flushes every table
  when stopped), and the imported table still in force beside
  Housecarl's. The docs say to disable nftables.service but not stop it.
- A raw rule with other fields set is refused (raw_conflict) instead of
  silently ignoring them; the rule dialog's nftables section hides what
  it replaces, and the importer's raw rules carry only their text.
- A dynamic set with configured entries is refused
  (set_dynamic_entries): they were silently ignored. The set dialog
  shows entries or the entry timeout, as fits.
- The rule dialog's chain choices are just the chains' names.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -35,7 +35,8 @@ the way Jarl and Steward are.
   review shows the problems, nftables' check and the diff of the ruleset.
   The web UI collects edits as pending changes by default (pending rows,
   a bar with Review and Apply now, a Changes page), with a switch for live
-  edits; hc stages with `-C ID` or `HOUSECARL_CHANGESET`, and has `hc
+  edits, and Undo in History is staged like any edit; hc stages with
+  `-C ID` or `HOUSECARL_CHANGESET`, and has `hc
   changeset create/list/show/diff/apply/discard/remove`. An applied
   changeset is on probation like any change. `--dry-run` shows the
   ruleset's diff too (docs/design.md, docs/cli.md).
@@ -66,6 +67,9 @@ the way Jarl and Steward are.
 - **At boot:** the confirmed ruleset is loaded by
   `housecarl-ruleset.service` before the network comes up, without
   housecarld. An empty configuration applies nothing.
+- **Warnings about the machine:** while `nftables.service` is enabled
+  (it loads `/etc/nftables.conf` at boot, and flushes every table when
+  stopped), and while the table an import came from still applies.
 - **Hits and the log:** packet and byte counters for every rule, NAT rule,
   built-in and policy; packets logged by rules and policies, read from
   netlink log group 4171 (`hc log -f`, the Log page).
@@ -81,7 +85,8 @@ the way Jarl and Steward are.
   chain with hits and reordering, NAT, zones, sets, services, the log,
   settings, import, history with undo; the rule dialog keeps the less
   used parts, such as rate limits, quotas and time windows, behind "+"
-  buttons), with users, roles, scoped API
+  buttons; each chain's built-ins are listed, with their hits, and
+  switched in a window), with users, roles, scoped API
   tokens, sessions, the audit log, and the web UI's certificate from
   Let's Encrypt through Jarl, as in Steward.
 - **Packaging:** Debian packages `housecarl` and `housecarl-cli`, a