Add optional query statistics

Off by default (stats in jarl.yaml). When enabled, Jarl adds a loopback
statistics channel and a response log to named's configuration (merged
into existing logging/statistics-channels statements) and switches
response logging with rndc responselog, because the responselog option
only counts when named starts. jarld polls named's counters every minute
and tails the response log (resuming after restarts and across
rotation). It stores aggregates, never individual queries, in a separate
SQLite database: per-minute, hourly and daily counters (queries, result
codes, record types, views, zones, cache hits, upstream latency, DNSSEC)
and hourly/daily top lists (names, clients, NXDOMAIN and SERVFAIL names,
refused clients), each with its own retention. Clients can be anonymized
or excluded.

- Web UI: Statistics page with KPI tiles, queries and failed answers over
  time, a weekday x hour heatmap, top lists and breakdowns; SVG charts
  with hover/keyboard readouts, a table view and light/dark palettes
  validated for colour-vision deficiency.
- CLI: jarl stats status|summary|top|timeline|heatmap|breakdown.
- API: /api/v1/stats/*, behind a new "stats" permission resource.
- jarld brings named's configuration up to date with jarl.yaml at
  startup (engine.SyncConfig), never overwriting hand-edited files.
- resync now refuses to overwrite drifted files without force, as
  documented.
- tmpfiles.d creates /var/log/named (allowed by named's AppArmor profile
  on Debian 13 and Ubuntu).
- The e2e harness runs named with -f like the Debian unit.
- docs/stats.md, plus API, CLI, configuration, permissions and README
  updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/stats/poll.go

@@ -0,0 +1,154 @@
+package stats
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// Snapshot is named's cumulative counters at one moment, flattened to the
+// keys Jarl stores (see Counters in docs/stats.md).
+type Snapshot struct {
+	BootTime string
+	Values   map[string]int64
+}
+
+// serverJSON is the part of /json/v1/server Jarl uses.
+type serverJSON struct {
+	BootTime string           `json:"boot-time"`
+	Opcodes  map[string]int64 `json:"opcodes"`
+	RCodes   map[string]int64 `json:"rcodes"`
+	QTypes   map[string]int64 `json:"qtypes"`
+	NSStats  map[string]int64 `json:"nsstats"`
+	Views    map[string]struct {
+		Resolver struct {
+			Stats      map[string]int64 `json:"stats"`
+			CacheStats map[string]int64 `json:"cachestats"`
+		} `json:"resolver"`
+	} `json:"views"`
+}
+
+// nsstatsKeys maps named's server counters to Jarl's counter names.
+var nsstatsKeys = map[string]string{
+	"QryAuthAns":   "answer:authoritative",
+	"QryNoauthAns": "answer:recursive",
+	"QryRecursion": "recursion",
+	"QryDropped":   "dropped",
+	"RateDropped":  "ratelimit:dropped",
+	"RateSlipped":  "ratelimit:slipped",
+	"QryTCP":       "transport:tcp",
+	"QryUDP":       "transport:udp",
+	"QryDuplicate": "duplicate",
+}
+
+// rttKeys maps named's upstream round-trip buckets to readable names.
+var rttKeys = map[string]string{
+	"QryRTT10":    "rtt:<10ms",
+	"QryRTT100":   "rtt:10-100ms",
+	"QryRTT500":   "rtt:100-500ms",
+	"QryRTT800":   "rtt:500-800ms",
+	"QryRTT1600":  "rtt:800-1600ms",
+	"QryRTT1600+": "rtt:>1600ms",
+}
+
+var dnssecKeys = map[string]string{"ValOk": "dnssec:valid", "ValNegOk": "dnssec:valid-negative", "ValFail": "dnssec:failed"}
+
+// Flatten turns the statistics channel's JSON into a snapshot.
+func Flatten(body []byte) (*Snapshot, error) {
+	var j serverJSON
+	if err := json.Unmarshal(body, &j); err != nil {
+		return nil, fmt.Errorf("unexpected statistics data: %w", err)
+	}
+	v := map[string]int64{"queries": j.Opcodes["QUERY"]}
+	for k, n := range j.RCodes {
+		if n != 0 && !strings.HasPrefix(k, "RESERVED") && (k[0] < '0' || k[0] > '9') {
+			v["rcode:"+k] = n
+		}
+	}
+	for k, n := range j.QTypes {
+		v["qtype:"+k] = n
+	}
+	for k, name := range nsstatsKeys {
+		if n := j.NSStats[k]; n != 0 {
+			v[name] = n
+		}
+	}
+	for _, view := range j.Views {
+		for k, name := range rttKeys {
+			v[name] += view.Resolver.Stats[k]
+		}
+		for k, name := range dnssecKeys {
+			v[name] += view.Resolver.Stats[k]
+		}
+		v["cache:hits"] += view.Resolver.CacheStats["QueryHits"]
+		v["cache:misses"] += view.Resolver.CacheStats["QueryMisses"]
+	}
+	for k, n := range v {
+		if n == 0 && k != "queries" {
+			delete(v, k)
+		}
+	}
+	return &Snapshot{BootTime: j.BootTime, Values: v}, nil
+}
+
+// Delta returns the change from prev to cur. When named restarted (its
+// boot time changed or a counter went down), the counters started again
+// from zero, so the current values are the change.
+func Delta(prev, cur *Snapshot) map[string]int64 {
+	out := map[string]int64{}
+	restarted := prev.BootTime != cur.BootTime
+	if !restarted {
+		for k, n := range cur.Values {
+			if n < prev.Values[k] {
+				restarted = true
+				break
+			}
+		}
+	}
+	for k, n := range cur.Values {
+		d := n
+		if !restarted {
+			d = n - prev.Values[k]
+		}
+		if d != 0 || k == "queries" {
+			out[k] = d
+		}
+	}
+	return out
+}
+
+// Poller reads named's statistics channel.
+type Poller struct {
+	URL    string // e.g. http://127.0.0.1:8058/json/v1/server
+	Client *http.Client
+}
+
+// NewPoller returns a poller for a statistics channel address.
+func NewPoller(addr string) *Poller {
+	return &Poller{URL: "http://" + addr + "/json/v1/server", Client: &http.Client{Timeout: 10 * time.Second}}
+}
+
+// Poll fetches a snapshot.
+func (p *Poller) Poll(ctx context.Context) (*Snapshot, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, p.URL, nil)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := p.Client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("named's statistics channel is not reachable (%v); is the configuration with statistics applied and named running?", err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 64<<20))
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("named's statistics channel answered %s", resp.Status)
+	}
+	return Flatten(body)
+}