Add optional query statistics

Off by default (stats in jarl.yaml). When enabled, Jarl adds a loopback
statistics channel and a response log to named's configuration (merged
into existing logging/statistics-channels statements) and switches
response logging with rndc responselog, because the responselog option
only counts when named starts. jarld polls named's counters every minute
and tails the response log (resuming after restarts and across
rotation). It stores aggregates, never individual queries, in a separate
SQLite database: per-minute, hourly and daily counters (queries, result
codes, record types, views, zones, cache hits, upstream latency, DNSSEC)
and hourly/daily top lists (names, clients, NXDOMAIN and SERVFAIL names,
refused clients), each with its own retention. Clients can be anonymized
or excluded.

- Web UI: Statistics page with KPI tiles, queries and failed answers over
  time, a weekday x hour heatmap, top lists and breakdowns; SVG charts
  with hover/keyboard readouts, a table view and light/dark palettes
  validated for colour-vision deficiency.
- CLI: jarl stats status|summary|top|timeline|heatmap|breakdown.
- API: /api/v1/stats/*, behind a new "stats" permission resource.
- jarld brings named's configuration up to date with jarl.yaml at
  startup (engine.SyncConfig), never overwriting hand-edited files.
- resync now refuses to overwrite drifted files without force, as
  documented.
- tmpfiles.d creates /var/log/named (allowed by named's AppArmor profile
  on Debian 13 and Ubuntu).
- The e2e harness runs named with -f like the Debian unit.
- docs/stats.md, plus API, CLI, configuration, permissions and README
  updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/engine.go

@@ -34,6 +34,9 @@ import (
 // Config configures the engine.
 type Config struct {
 	Paths render.Paths
+	// Extras are statements added from jarld's configuration, such as the
+	// statistics channel and response log for query statistics.
+	Extras render.Extras
 	// MainConfig is the configuration file named loads (on Debian
 	// /etc/bind/named.conf). Jarl is "adopted" once it includes Jarl's
 	// named.conf. If it is Jarl's named.conf itself, Jarl is always
@@ -412,7 +415,7 @@ func (e *Engine) makePlan(ctx context.Context, base, work *model.State, user str
 		return pl, nil
 	}
 	pl.serials = bumpSerials(base, work, e.Now(), user)
-	pl.out = render.Render(work, e.cfg.Paths)
+	pl.out = render.Render(work, e.cfg.Paths, e.cfg.Extras)
 	deployed, err := e.store.DeployedFiles(ctx)
 	if err != nil {
 		return nil, err
@@ -448,7 +451,7 @@ func (e *Engine) makePlan(ctx context.Context, base, work *model.State, user str
 	pl.diff = diff.String()
 
 	// Which zones named must reload, and which serials to verify.
-	baseOut := render.Render(base, e.cfg.Paths)
+	baseOut := render.Render(base, e.cfg.Paths, e.cfg.Extras)
 	changedPaths := map[string]bool{}
 	for _, f := range pl.changed {
 		changedPaths[f.Path] = true
@@ -494,7 +497,7 @@ func (e *Engine) stagingCheck(ctx context.Context, pl *plan) error {
 	}
 	defer os.RemoveAll(dir)
 	sp := render.Paths{ConfigDir: filepath.Join(dir, "config"), ZoneDir: filepath.Join(dir, "zones"), CacheDir: filepath.Join(dir, "cache")}
-	sout := render.Render(pl.work, sp)
+	sout := render.Render(pl.work, sp, e.cfg.Extras)
 	for _, f := range sout.Files {
 		if err := os.MkdirAll(filepath.Dir(f.Path), 0o750); err != nil {
 			return err
@@ -969,6 +972,13 @@ func (e *Engine) Resync(ctx context.Context, p *auth.Principal, opts ApplyOption
 	if opts.DryRun {
 		return res, nil
 	}
+	if len(pl.drift) > 0 && !opts.Force {
+		var paths []string
+		for _, d := range pl.drift {
+			paths = append(paths, d.Path+" ("+d.Reason+")")
+		}
+		return res, &Error{Kind: KindDrift, Message: "files managed by Jarl were changed outside Jarl: " + strings.Join(paths, ", ") + "; resync with force to overwrite them"}
+	}
 	// Verify every primary zone and reload them all.
 	pl.configChanged = true
 	pl.reloadZones = nil
@@ -1000,6 +1010,47 @@ func (e *Engine) Resync(ctx context.Context, p *auth.Principal, opts ApplyOption
 	return res, nil
 }
 
+// SyncConfig rewrites named's configuration when it differs from what the
+// database and jarld's own configuration produce, for example after query
+// statistics were switched on or off in jarl.yaml. Files changed by hand
+// are never overwritten. It reports whether anything was written.
+func (e *Engine) SyncConfig(ctx context.Context) (bool, *Result, error) {
+	dry, err := e.Resync(ctx, auth.System, ApplyOptions{DryRun: true})
+	if err != nil || len(dry.Files) == 0 {
+		return false, dry, err
+	}
+	res, err := e.Resync(ctx, auth.System, ApplyOptions{})
+	return err == nil, res, err
+}
+
+// SetResponseLogging turns named's response logging on or off with rndc.
+// The responselog option only takes effect when named starts, so query
+// statistics switch it at runtime. It reports whether it changed.
+func (e *Engine) SetResponseLogging(ctx context.Context, on bool) (bool, error) {
+	if e.cfg.NoReload || e.tools == nil {
+		return false, nil
+	}
+	out, err := e.tools.RNDCRun(ctx, "status")
+	if err != nil {
+		return false, err
+	}
+	want := "response logging is OFF"
+	if !on {
+		want = "response logging is ON"
+	}
+	if !strings.Contains(out, want) {
+		return false, nil // already as wanted (or too old a named to say)
+	}
+	arg := "on"
+	if !on {
+		arg = "off"
+	}
+	if _, err := e.tools.RNDCRun(ctx, "responselog", arg); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
 // CheckCurrent validates the stored configuration and runs named-checkconf
 // on it without changing anything.
 func (e *Engine) CheckCurrent(ctx context.Context) (*Result, error) {