Add DNSSEC signing, key backups and Porkbun support

Zones get a DNSSEC setting: named signs them with BIND's default (or a
custom) dnssec-policy and inline signing, with keys in a per-view key
directory. Jarl shows the keys, the DS record and when it is safe to
publish it, checks the parent's DS records (check-ds, which also tells
named), and refuses steps that would break a signed domain: switching
straight to unsigned, finishing a turn-off too early, deleting or moving
a signed zone, TTLs above max-zone-ttl. Turning off goes through the
insecure policy; wipe starts over once the parent has no DS.

Backups store the DNSSEC keys and restore puts them back for named; the
backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's
serial above named's whenever it writes an older one (after a restore).
The serials check compares the signed serial.

With a Porkbun API key in jarl.yaml, the registrar's name servers, glue
records and DS records can be shown and changed, each change checked
first (dry run, force to override).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/concepts.md

@@ -40,8 +40,8 @@ renders the complete configuration from the database:
 `jarld adopt` turns `/etc/bind/named.conf` into a single
 `include "/etc/bind/jarl/named.conf";`, so named loads only what Jarl
 generates. Zone files go under `/var/lib/bind` because Debian's AppArmor
-profile lets named write there. That keeps journals and future DNSSEC
-signing working.
+profile lets named write there: its journals, the signed copies of zones
+it signs, and their keys (under `dnssec-keys/`, see [dnssec.md](dnssec.md)).
 
 Because files are always regenerated, anything you edit by hand is
 overwritten. Jarl records a checksum of every file it writes and reports
@@ -290,8 +290,6 @@ journal through jarld's log.
 * **Dynamic updates** (`allow-update`, `update-policy`): named would write
   to zone files that Jarl regenerates, so the validator rejects them on Jarl
   zones. Use the API (for example `jarl acme`) instead of nsupdate.
-* **DNSSEC signing**: not managed yet. The zone directory is
-  named-writable, so `dnssec-policy` can be added later.
 * **Several servers from one jarld**: each jarld manages the named on its
   own host. A second server runs its own jarld with secondary zones, which
   copy the primary's zones by normal AXFR/IXFR (see "A secondary server" in