Keep built-ins and policies out of the busiest rules

The established built-in passes most of the traffic, so it topped the
statistics' busiest rules every time and made every rule's bar look
empty. The summary now lists rules and NAT objects in rules, and
built-ins and policies in builtins; the Statistics page and hc stats
show them as two lists.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/stats.md

@@ -5,7 +5,9 @@ Housecarl keeps what the firewall did over time:
 - traffic per interface and zone, received and sent;
 - packets dropped, by chain, and when drops happen (a weekday × hour
   heatmap);
-- hits per rule, built-in and policy, and the rules that matched nothing;
+- hits per rule, and per built-in and policy in a list of their own (the
+  established built-in counts most packets), and the rules that matched
+  nothing;
 - the sources blocked most and what they tried (from the log);
 - traffic per inside device (a setting, below);
 - connections tracked, against the kernel's limit;
@@ -127,7 +129,7 @@ answer.
 | Endpoint | |
 |---|---|
 | `GET /stats/status` | `enabled`, `database`, `size`, `first_data`, `last_sample`, `sample_error`, `per_device`, `retention`, `latest` (the newest gauges) |
-| `GET /stats/summary?since=24h&limit=10` | `zones` and `interfaces` (`name`, `received`, `sent`), `drops`, `drops_by_chain`, `rules` (busiest, named), `peak_connections`, `conntrack_max`, `blocked_sources`, `blocked_ports`, `devices_up`, `devices_down` |
+| `GET /stats/summary?since=24h&limit=10` | `zones` and `interfaces` (`name`, `received`, `sent`), `drops`, `drops_by_chain`, `rules` (busiest rules and NAT objects, named), `builtins` (busiest built-ins and policies, named), `peak_connections`, `conntrack_max`, `blocked_sources`, `blocked_ports`, `devices_up`, `devices_down` |
 | `GET /stats/timeline?keys=zrx:*,drops&since=24h&step=auto` | `step`, `times` (bucket starts), `series` (`key`, `values`); `GROUP:*` means every key of a group; `step` is `auto`, `1m`, `5m`, `15m`, `1h`, `6h` or `1d`; a gauge without a sample is -1 |
 | `GET /stats/top?kind=device_down&since=7d&limit=20` | a top list (`key`, `count`) |
 | `GET /stats/hits?since=30d` | packets per rule, built-in and policy (`key`, `count`, `name`), with the enabled rules that counted none |