Keep built-ins and policies out of the busiest rules

The established built-in passes most of the traffic, so it topped the
statistics' busiest rules every time and made every rule's bar look
empty. The summary now lists rules and NAT objects in rules, and
built-ins and policies in builtins; the Statistics page and hc stats
show them as two lists.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -124,6 +124,11 @@ All notable changes to Housecarl are documented here. The format follows
 
 ### Changed
 
+- Statistics' "Busiest rules" (the Statistics page, `hc stats`,
+  `GET /stats/summary`) lists only rules and NAT objects. Built-ins and
+  policies have their own list ("Built-ins and policies", `builtins` in
+  the API): the established built-in passes most of the traffic, so it
+  topped the list every time and made every rule's bar look empty.
 - `hc user delete` asks first, as every other delete does, and takes
   `-y`/`--yes` not to; it deleted the user and their tokens at once.
 - The ruleset's diff (Changes, `hc changeset diff`, `--dry-run`) names