Sets from Jarl: sets holding the addresses of names in Jarl

A set can take its addresses from Jarl: every A and AAAA record of its
names (NAME@VIEW), CNAMEs followed within Jarl's zones in the same view.
housecarld reads them every jarl.refresh and after each change, keeps
only the addresses within the zones and networks the set allows, and
keeps what it last read (saved in the database and the boot ruleset)
while Jarl can't be reached. A change of the addresses applies the
ruleset again without a history entry and is audited (set.jarl).

hc set add --jarl --within, hc set jarl; the kind "from Jarl" and
Addresses… on the Sets page; GET /sets/{name}/jarl and /jarl/refresh;
validation codes set_jarl_*, status warnings jarl_*; docs/jarl.md.
e2e phase with scripts/fakejarl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/rules.md

@@ -83,6 +83,19 @@ change to the ruleset, and a restart of housecarld; a reboot empties
 them. A token can be limited to one set ([permissions.md](permissions.md)):
 that is how another program (Steward's captive portal) lets a client in.
 
+A set **from Jarl** holds the addresses of names in Jarl, the BIND
+manager: every A and AAAA record of each name, CNAMEs followed, read again
+every minute. Only addresses within the zones and networks it names are
+used, so a changed record can't open the firewall to anything else:
+
+```sh
+hc set add nas --jarl nas.example.com@internal --within lan
+hc set jarl nas                                      # what it holds, and why
+```
+
+Views, CNAMEs, what happens when Jarl can't be reached and the rest are in
+[jarl.md](jarl.md#sets-from-jarl).
+
 ## Services
 
 A service names ports of a protocol (`tcp`, `udp`, `sctp`) and ICMP