Staged undo, built-ins window, machine warnings; raw and dynamic set fixes

- Undo is staged like any edit: in review mode the web UI's Undo, and hc
  history undo with -C or HOUSECARL_CHANGESET, add a revert operation
  that checks, when replayed, that nothing it touches changed since;
  applied, History links the entries. Imports and takeovers still can't
  be staged.
- The rules page sums up a chain's built-ins in one line; a window lists
  them with what they do and their hits, and switches them.
- Warnings about the machine (dashboard, hc status): nftables.service
  enabled (it loads /etc/nftables.conf at boot and flushes every table
  when stopped), and the imported table still in force beside
  Housecarl's. The docs say to disable nftables.service but not stop it.
- A raw rule with other fields set is refused (raw_conflict) instead of
  silently ignoring them; the rule dialog's nftables section hides what
  it replaces, and the importer's raw rules carry only their text.
- A dynamic set with configured entries is refused
  (set_dynamic_entries): they were silently ignored. The set dialog
  shows entries or the entry timeout, as fits.
- The rule dialog's chain choices are just the chains' names.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/validate/validate.go

@@ -85,6 +85,35 @@ func Check(st *model.State, env *Env) []Problem {
 	return c.out
 }
 
+// rawIgnores names what a raw rule has besides its text, which the
+// ruleset wouldn't use (the action too is the text's; it isn't checked).
+func rawIgnores(r *model.Rule) []string {
+	m := r.Match
+	var out []string
+	for _, x := range []struct {
+		name string
+		set  bool
+	}{
+		{"zones", len(m.InZones) > 0 || len(m.OutZones) > 0},
+		{"addresses", len(m.Sources) > 0 || len(m.Destinations) > 0},
+		{"services", len(m.Services) > 0},
+		{"family", m.Family != ""},
+		{"connection state", len(r.CtState) > 0 || len(r.CtStatus) > 0},
+		{"time window", len(r.Days) > 0 || r.HourFrom != "" || r.HourTo != ""},
+		{"rate limit", r.Limit != nil},
+		{"connection limit", r.ConnLimit != 0},
+		{"quota", r.Quota != nil},
+		{"address grouping", r.GroupV4 != 0 || r.GroupV6 != 0},
+		{"log", r.Log || r.LogPrefix != ""},
+		{"reject with", r.RejectWith != ""},
+	} {
+		if x.set {
+			out = append(out, x.name)
+		}
+	}
+	return out
+}
+
 // maxByteRate is the largest byte rate per period nftables (1.1.3) can
 // hold: the kernel's token bucket multiplies the rate by the period.
 var maxByteRate = map[string]int64{"second": 4294967294, "minute": 307445734, "hour": 5124095, "day": 213503}
@@ -202,6 +231,9 @@ func (c *checker) sets() {
 				c.add(Error, "set_entry", obj, "%v", err)
 			}
 		}
+		if len(s.Entries) > 0 && s.Dynamic {
+			c.add(Error, "set_dynamic_entries", obj, "a dynamic set gets its entries at run time (hc set entries add, the Entries button), each with its timeout; leave out the configured ones, or make it a set that isn't dynamic")
+		}
 		if len(s.Entries) == 0 && !s.Dynamic {
 			c.add(Warning, "set_empty", obj, "the set is empty: rules using it match nothing")
 		}
@@ -331,6 +363,9 @@ func (c *checker) rule(r *model.Rule) {
 		if strings.ContainsAny(r.Raw, ";\n\r") {
 			c.add(Error, "raw_rule", obj, "a raw rule is one nftables rule on one line, without ;")
 		}
+		if ignored := rawIgnores(r); len(ignored) > 0 {
+			c.add(Error, "raw_conflict", obj, "a raw rule is used as written, so its %s would be ignored: write them in the nftables rule, or leave them out", strings.Join(ignored, ", "))
+		}
 		return
 	}
 	in := r.Chain != model.ChainOutput