Give the DS command for a parent zone in Jarl, and allow port 443

The DNSSEC tab and 'jarl zone dnssec status' give the jarl record add
command (and an Add to parent button) when the parent zone is in Jarl.
jarl.service grants CAP_NET_BIND_SERVICE so the web UI can listen on 443.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_dnssec.go

@@ -37,7 +37,12 @@ func (s *Server) zoneDNSSEC(w http.ResponseWriter, r *http.Request, p *auth.Prin
 	}
 	resp := api.DNSSECResponse{Zone: z.Name, View: st.ViewName(z), Type: z.Type, Status: s.eng.DNSSEC(r.Context(), st, z), Registrar: s.registrarFor(z)}
 	if pz := parentInJarl(st, z); pz != nil {
-		resp.ParentZone = pz.Name
+		resp.ParentZone, resp.ParentZoneID, resp.ParentView = pz.Name, pz.ID, st.ViewName(pz)
+		for _, rec := range st.ServedRecords(pz.ID) {
+			if rec.Name == z.Name && rec.Type == "DS" {
+				resp.ParentDS = append(resp.ParentDS, rec.Data)
+			}
+		}
 	}
 	writeJSON(w, http.StatusOK, resp)
 	return nil