Add DNSSEC signing, key backups and Porkbun support

Zones get a DNSSEC setting: named signs them with BIND's default (or a
custom) dnssec-policy and inline signing, with keys in a per-view key
directory. Jarl shows the keys, the DS record and when it is safe to
publish it, checks the parent's DS records (check-ds, which also tells
named), and refuses steps that would break a signed domain: switching
straight to unsigned, finishing a turn-off too early, deleting or moving
a signed zone, TTLs above max-zone-ttl. Turning off goes through the
insecure policy; wipe starts over once the parent has no DS.

Backups store the DNSSEC keys and restore puts them back for named; the
backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's
serial above named's whenever it writes an older one (after a restore).
The serials check compares the signed serial.

With a Porkbun API key in jarl.yaml, the registrar's name servers, glue
records and DS records can be shown and changed, each change checked
first (dry run, force to override).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -45,12 +45,20 @@ error: www.adbraun.lol has a CNAME, so it can't have any other records (found A)
   limited.
 * **Audit log** of every login, change and token, with user, token, IP and
   outcome.
-* **Daily backups** of the database by a systemd timer, checked as they are
-  written, with retention that never deletes the last few; `jarld restore`
-  puts one back safely.
+* **Daily backups** of the database and the DNSSEC keys by a systemd timer,
+  checked as they are written, with retention that never deletes the last
+  few; `jarld restore` puts one back safely, and raises zone serials so
+  named and the secondaries take the restored data.
 * **Name server checks**: whether the secondaries serve the current serial,
   and, for zones on the internet, whether the parent zone delegates them
-  to the right name servers with the right glue.
+  to the right name servers with the right glue and DS records.
+* **DNSSEC signing** per zone, by BIND itself, with every step that involves
+  the parent zone guarded: Jarl says when the DS record can be published,
+  refuses to make a zone unsigned while its DS may still be out there, turns
+  signing off in safe steps, and can wipe the slate clean.
+* **Porkbun support** (optional): the domain's name servers, glue records
+  (any number, IPv4 and IPv6) and DS records at the registrar, set from Jarl
+  after checks that the change won't take the domain offline.
 * **No token needed on the server**: root's `sudo jarl ...` talks to jarld
   over a local unix socket, so a lost token or password never locks you
   out.
@@ -99,6 +107,7 @@ in `/etc/jarl/jarl.yaml` to reach it from your management network.
 | [docs/api.md](docs/api.md) | REST API reference |
 | [docs/permissions.md](docs/permissions.md) | Users, tokens, grants and roles |
 | [docs/views.md](docs/views.md) | Split DNS: adding views to a server that has none |
+| [docs/dnssec.md](docs/dnssec.md) | DNSSEC signing, going public with your own name servers, Porkbun |
 | [docs/acme.md](docs/acme.md) | Let's Encrypt DNS-01 with certbot, acme.sh, lego and Traefik |
 | [docs/stats.md](docs/stats.md) | Query statistics: enabling, what is collected, retention |
 | [docs/validation.md](docs/validation.md) | Every check Jarl makes |
@@ -121,8 +130,10 @@ these pages:
   fields adapt to the zone type), per-zone records
   with inline editing, type-specific hints and a preview of the exact record
   that will be added (reverse zones take addresses and suggest host names), settings (SOA, TTL, serial
-  policy, view), options, the generated zone file, and pasting a zone file
-  to merge or replace records.
+  policy, view), options, the generated zone file, pasting a zone file
+  to merge or replace records, name server checks, DNSSEC (keys, the DS
+  record to copy, and each step with what it needs first) and, with a
+  Porkbun key, the registrar.
 * **Views, ACLs, TSIG keys, Server options**: wherever an address match list
   is entered, the existing ACLs and keys are offered and unknown names are
   flagged. The options editor knows every