Hub stage 4: config history, rollback, drift check, baseline export and import

Every saved config, and every earlier baseline, is listed per app. You
can view it, diff it against a server's current config, and roll it back
through preview and apply. Earlier baselines can be restored.

A drift check (HUB_DRIFT_MINUTES, default 15) compares each server with
its effective config. Drift shows in the header and the matrix, with
Accept as baseline and Revert to baseline. All baselines export to one
file. Importing that file shows a dry run before it writes.

Rolling back preselects, and diffs against, the server the version came
from. The line-diff op "del" is renamed to "remove" for the language lint.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/compose.hub.example.yaml

@@ -40,6 +40,8 @@ services:
       - HUB_DATA=/data
       # За Traefik: брать адрес клиента из X-Forwarded-For (для ограничения попыток входа и журнала)
       - HUB_TRUST_PROXY=1
+      # Как часто проверять, что конфиги серверов не разошлись с эталоном (минуты, 0 выключает)
+      # - HUB_DRIFT_MINUTES=15
       - HUB_DOMAIN=dnss.shnt.top
       - TZ=Asia/Novosibirsk
     labels: