Give every view a TSIG key that selects it

Each view's match-clients starts with "key jarl-view-NAME" (after
"!key" for the views listed after it), so a query signed with a view's
key lands in that view from any address. The secrets are derived from a
random seed in Jarl's database. The delegation check signs its queries
to this server's own addresses with the key of the zone's view: before,
they got whichever view matched the server's address, usually internal.
jarl view key / GET /views/{id}/key show a key for dig -k (tsig:write,
audited). jarl-view- key names are reserved; the importer drops view
keys from a configuration Jarl wrote.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_nscheck.go

@@ -160,6 +160,9 @@ func (s *Server) zoneDelegation(w http.ResponseWriter, r *http.Request, p *auth.
 		return badRequest("the delegation check compares the parent's delegation with the zone's NS records, so it needs a primary zone (this is a %s zone; check it where its primary is)", z.Type)
 	}
 	c := s.checker()
+	// This server's own addresses are asked too: sign those queries with
+	// the key of the zone's view, so they get that view's answer.
+	c.LocalKey = s.eng.ViewKey(r.Context(), st, z)
 	if v := r.URL.Query().Get("resolver"); v != "" {
 		// An address only, always port 53: this is a DNS resolver.
 		a, err := netip.ParseAddr(v)