Mark signed zones with a padlock, and name clients in statistics

The zones list shows a padlock after signed zones, linking to their
DNSSEC tab. Client lists in the statistics show the host name Jarl's
records have for each address (PTR, else A/AAAA); no DNS queries.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/api.md

@@ -486,7 +486,7 @@ Needs `stats:read`. When statistics are disabled, every endpoint but
 | GET | `/stats/status` | | `{enabled, query_log, statistics_channel, log_file, last_poll, last_log_line, log_lines_read, first_data, retention, warnings}` |
 | GET | `/stats/summary` | `since` (90m, 24h, 7d, 2w; default 24h), `top` (default 10) | totals, `avg_qps`, `peak`, `rcodes`, `qtypes`, `views`, `zones`, `answers`, `transport`, `cache_hit_ratio`, `nxdomain_ratio`, `tops` |
 | GET | `/stats/timeline` | `since`, `step` (auto, 1m, 5m, 15m, 1h, 6h, 1d), `key` (repeatable or comma separated; `rcode:*` = every counter of a group; default `queries`) | `{step, times: [unix...], series: [{key, values}]}` |
-| GET | `/stats/top` | `kind` (name, client, nxdomain, servfail, refused), `since`, `limit` (default 20) | `[{key, count}]` |
+| GET | `/stats/top` | `kind` (name, client, nxdomain, servfail, refused), `since`, `limit` (default 20) | `[{key, count}]`; client and refused entries add `name`, the host name of Jarl's record for the address (the summary's client list too) |
 | GET | `/stats/heatmap` | `since` (default 28d), `key` (default queries) | `{key, from, avg[7][24], samples[7][24]}`, Monday first, local time, `-1` = no data |
 | GET | `/stats/breakdown` | `group` (qtype, rcode, view, zone, answer, transport, rtt, dnssec, cache, ratelimit), `since` | `[{key, count}]` |
 

docs/stats.md

@@ -111,6 +111,16 @@ Nothing else is stored. In particular there's no per-query record, so you
 can't look up "who asked for X at 14:02". That is deliberate, both for size
 and privacy.
 
+**Client names.** Where the client lists (busiest and refused clients) show
+an address Jarl has a record for, they show its host name too: the PTR
+record's target, or else the name of an A/AAAA record with that address
+(disabled records don't count, and only records you may read). This is
+looked up in Jarl's own data when the list is shown, not stored and not
+asked of DNS, so it is instant and adds no queries of its own. The name is
+what the records say now: with DHCP, an address seen last week may have
+been another machine. Anonymized clients (`anonymize_clients`) are
+prefixes and get no name.
+
 ## Using it
 
 **Web UI**: Statistics. Pick a range (1 hour to 90 days); everything on the