Effective config: do-0x20-encode revert fix, validation UI, custom displays, option help

- Fix do-0x20-encode: clearing pending when toggling back to original (Disabled/Default)
  - Do0x20EncodeDisplay: uncheck uses pending.OldValue when present
  - EffectiveConfigFieldDisplay: use pending.OldValue as _valueAtActivation when re-entering with pending
- Effective config: validation errors/warnings in toolbar and save modal, revert from modal
- Custom displays: Do0x20EncodeDisplay (tri-state), KeyOnlyOrValueDisplay
- ExplicitToggleState, config/apply support for do-0x20-encode, option help and tests

scripts/extract-option-help.sh

@@ -171,6 +171,57 @@ OPTION_KEYS = [
     "keep-in-foreground",
     "no-daemon",
     "conntrack",
+    "connmark-allowlist-enable",
+    "no-round-robin",
+    "dns-forward-max",
+    "connmark-allowlist",
+    "do-0x20-encode",
+    "caa-record",
+    "dns-rr",
+    "synth-domain",
+    "auth-zone",
+    "auth-soa",
+    "auth-sec-servers",
+    "auth-peer",
+    "leasequery",
+    "dhcp-generate-names",
+    "dhcp-broadcast",
+    "dhcp-sequential-ip",
+    "dhcp-ignore-clid",
+    "bootp-dynamic",
+    "no-ping",
+    "script-arp",
+    "script-on-renewal",
+    "dhcp-no-override",
+    "dhcp-alternate-port",
+    "dhcp-duid",
+    "dhcp-luascript",
+    "dhcp-scriptuser",
+    "dhcp-relay",
+    "dhcp-circuitid",
+    "dhcp-remoteid",
+    "dhcp-subscrid",
+    "dhcp-proxy",
+    "tag-if",
+    "bridge-interface",
+    "shared-network",
+    "dhcp-pxe-vendor",
+    "dhcp-option-pxe",
+    "dnssec-no-timecheck",
+    "dnssec-debug",
+    "add-cpe-id",
+    "dnssec-timestamp",
+    "dnssec-limits",
+    "dumpfile",
+    "dumpmask",
+    "use-stale-cache",
+    "add-mac",
+    "add-subnet",
+    "umbrella",
+    "quiet-dhcp",
+    "quiet-dhcp6",
+    "quiet-ra",
+    "quiet-tftp",
 ]
 
 long_opt_re = re.compile(r"--([a-z][a-z0-9-]*)(?:=[^,\s]*)?", re.IGNORECASE)