Staged undo, built-ins window, machine warnings; raw and dynamic set fixes

- Undo is staged like any edit: in review mode the web UI's Undo, and hc
  history undo with -C or HOUSECARL_CHANGESET, add a revert operation
  that checks, when replayed, that nothing it touches changed since;
  applied, History links the entries. Imports and takeovers still can't
  be staged.
- The rules page sums up a chain's built-ins in one line; a window lists
  them with what they do and their hits, and switches them.
- Warnings about the machine (dashboard, hc status): nftables.service
  enabled (it loads /etc/nftables.conf at boot and flushes every table
  when stopped), and the imported table still in force beside
  Housecarl's. The docs say to disable nftables.service but not stop it.
- A raw rule with other fields set is refused (raw_conflict) instead of
  silently ignoring them; the rule dialog's nftables section hides what
  it replaces, and the importer's raw rules carry only their text.
- A dynamic set with configured entries is refused
  (set_dynamic_entries): they were silently ignored. The set dialog
  shows entries or the entry timeout, as fits.
- The rule dialog's chain choices are just the chains' names.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/rules.md

@@ -38,7 +38,10 @@ directly (`--from 192.168.1.3`); a set is better when several rules share
 them.
 
 A **dynamic** set's entries are added at run time, each with a timeout,
-and nftables removes them when it runs out, even with housecarld stopped:
+and nftables removes them when it runs out, even with housecarld stopped.
+It has no configured entries (validation refuses them); its timeout is
+the default for entries added without one, and without a timeout they
+stay until removed:
 
 ```sh
 hc set add guests --dynamic --timeout 24h
@@ -193,8 +196,11 @@ hand, placed like any other:
 hc rule add forward --raw 'iifname != "wan" ct state invalid ip daddr @trusted_v4 accept'
 ```
 
-It is checked by nftables with the rest of the ruleset, and can use the
-sets' nftables names (`@trusted_v4`). The importer makes raw rules from
+It is used exactly as written: its text replaces the rule's zones,
+addresses, services, action, limits and log, so a raw rule with any of
+those set is refused (`raw_conflict`); write them in the text. It is
+checked by nftables with the rest of the ruleset, and can use the sets'
+nftables names (`@trusted_v4`). The importer makes raw rules from
 what it can't translate. It goes into the ruleset as written: add
 `counter` to it to count its packets.