Confirm changes automatically from the client that made them

A change made over the network answers with a one-time confirm_token
and closes its connection (HTTP/2: a GOAWAY). The web UI and hc send the
token straight back to /confirm, which accepts it only for the newest
change, from the same user and API token, the same address, and over a
new connection: proof that the client can still reach the API through
the new ruleset (an established connection would get through anyway). A
change that cuts its client off can't be confirmed so, and rolls back by
itself. The setting manual_confirm (hc settings set --auto-confirm off)
and hc --no-confirm leave confirming to a person. Changes through the
local socket still need no confirmation. e2e: 136 checks, among them a
lockout change rolled back without anyone confirming.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -172,11 +172,11 @@ run "probation of 10 seconds" 0 H settings set --probation 10s
 TOKEN=$(R /w/housecarld -c /w/housecarl.yaml user token admin e2e 2>/dev/null | tail -1)
 C() { docker exec ${P}-client /w/hc --config /w/cli.yaml --server http://$LAN4:8070 --token "$TOKEN" "$@"; }
 run "the API from the LAN" 0 C whoami
-run "a change over the network is on probation" 0 C zone add guests --interface guest0
+run "a change over the network is on probation" 0 C --no-confirm zone add guests --interface guest0
 contains "applied on probation"
 run "confirmed" 0 C confirm
 contains "confirmed 1 change;"
-run "a change that cuts the client off" 0 C rule disable "$APIRULE"
+run "a change that cuts the client off" 0 C --no-confirm rule disable "$APIRULE"
 contains "on probation"
 run "the client is cut off (a timeout)" 124 docker exec ${P}-client timeout 3 /w/hc --config /w/cli.yaml --server http://$LAN4:8070 --token "$TOKEN" whoami
 sleep 12
@@ -185,6 +185,25 @@ run "the rule is enabled again" 0 H rule show "$APIRULE"
 not_contains "disabled"
 run "the rollback is in the history" 0 H history list
 contains "rollback"
+# Confirmed by the client itself: it reached the API over a new connection.
+run "a change confirmed by its client" 0 C zone add guests2 --interface guest2
+contains "applied and confirmed"
+run "nothing waits" 0 C status
+not_contains "Probation:"
+run "the confirmation is audited" 0 H audit --action config.confirm
+contains "confirmed automatically"
+# A change that cuts its client off can't be confirmed by it: rolled back.
+run "a lockout change, not confirmed" 0 C rule disable "$APIRULE"
+contains "couldn't confirm it"
+sleep 3
+run "rolled back: the client is back" 0 C whoami
+run "the rule is enabled again" 0 H rule show "$APIRULE"
+not_contains "disabled"
+run "a person must confirm, by setting" 0 H settings set --auto-confirm off
+run "then a change waits" 0 C zone add guests3 --interface guest3
+contains "applied on probation"
+run "confirmed by a person" 0 C confirm
+run "back to automatic" 0 H settings set --auto-confirm on
 
 # ---- changesets: staged, reviewed, applied together
 
@@ -209,8 +228,8 @@ run "remove the forward operation" 0 CE changeset remove 3
 contains "has 2 operations"
 run "the diff without it" 0 CE changeset diff
 not_contains "dnat ip to 10.88.10.57"
-run "applied together" 0 CE changeset apply
-contains "applied on probation"
+run "applied together, and confirmed by this client" 0 CE changeset apply
+contains "applied and confirmed"
 contains "HOUSECARL_CHANGESET still names changeset $CS"
 run "one history entry" 0 H history list
 contains "e2e batch"