Give the DS command for a parent zone in Jarl, and allow port 443

The DNSSEC tab and 'jarl zone dnssec status' give the jarl record add
command (and an Add to parent button) when the parent zone is in Jarl.
jarl.service grants CAP_NET_BIND_SERVICE so the web UI can listen on 443.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/dnssec.md

@@ -122,8 +122,18 @@ can make validating resolvers reject cached answers. Then:
    [DNSViz](https://dnsviz.net/) gives an independent picture.
 
 If the parent zone is itself a primary zone in Jarl (`home.adbraun.lol`
-inside `adbraun.lol`), the DNSSEC tab says so: add the DS as a record in
-that zone.
+inside `adbraun.lol`), the DS goes in as a record in that zone, and Jarl
+gives you both ways to add it: an **Add to adbraun.lol** button on the
+DNSSEC tab, and the command, which `jarl zone dnssec status` prints too:
+
+```sh
+jarl record add adbraun.lol home DS 51126 13 2 FFBECE3D...
+```
+
+Once the parent zone has it, the tab and `status` say so. When turning
+signing off, the steps give the matching `jarl record delete adbraun.lol
+home DS`. The zone must be delegated first (NS records for `home` in
+`adbraun.lol`), or validation refuses the DS.
 
 ## Putting your own name servers on the internet