Staged undo, built-ins window, machine warnings; raw and dynamic set fixes

- Undo is staged like any edit: in review mode the web UI's Undo, and hc
  history undo with -C or HOUSECARL_CHANGESET, add a revert operation
  that checks, when replayed, that nothing it touches changed since;
  applied, History links the entries. Imports and takeovers still can't
  be staged.
- The rules page sums up a chain's built-ins in one line; a window lists
  them with what they do and their hits, and switches them.
- Warnings about the machine (dashboard, hc status): nftables.service
  enabled (it loads /etc/nftables.conf at boot and flushes every table
  when stopped), and the imported table still in force beside
  Housecarl's. The docs say to disable nftables.service but not stop it.
- A raw rule with other fields set is refused (raw_conflict) instead of
  silently ignoring them; the rule dialog's nftables section hides what
  it replaces, and the importer's raw rules carry only their text.
- A dynamic set with configured entries is refused
  (set_dynamic_entries): they were silently ignored. The set dialog
  shows entries or the entry timeout, as fits.
- The rule dialog's chain choices are just the chains' names.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -240,9 +240,14 @@ contains "^jellyfin$"
 run "a stale HOUSECARL_CHANGESET is refused" 1 CE zone add stale -i stale0
 contains "is applied"
 CS2=$(H changeset create -q)
-run "an undo can't be staged" 6 H -C "$CS2" history undo 1
+UNDO=$(H zone add undome -i undo0 | sed -n 's/.*history \([0-9]*\);.*/\1/p')
+run "an undo is staged" 0 H -C "$CS2" history undo "$UNDO"
+contains "staged in changeset $CS2"
+run "not applied yet: the zone is there" 0 H zone show undome
+run "an import can't be staged" 6 sh -c "echo '{\"nftables\":[]}' | docker exec -i ${P}-router /w/hc -C $CS2 import -"
 contains "can't be staged"
 run "discarded" 0 H changeset discard "$CS2"
+run "the zone stays" 0 H zone show undome
 run "a dry run shows the ruleset's diff" 0 H -n set add e2e_dry 10.1.2.3
 contains "^+.*set e2e_dry_v4"