Add DNSSEC signing, key backups and Porkbun support

Zones get a DNSSEC setting: named signs them with BIND's default (or a
custom) dnssec-policy and inline signing, with keys in a per-view key
directory. Jarl shows the keys, the DS record and when it is safe to
publish it, checks the parent's DS records (check-ds, which also tells
named), and refuses steps that would break a signed domain: switching
straight to unsigned, finishing a turn-off too early, deleting or moving
a signed zone, TTLs above max-zone-ttl. Turning off goes through the
insecure policy; wipe starts over once the parent has no DS.

Backups store the DNSSEC keys and restore puts them back for named; the
backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's
serial above named's whenever it writes an older one (after a restore).
The serials check compares the signed serial.

With a Porkbun API key in jarl.yaml, the registrar's name servers, glue
records and DS records can be shown and changed, each change checked
first (dry run, force to override).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/configuration.md

@@ -39,8 +39,8 @@ Durations accept Go syntax (`90s`, `15m`, `12h`) and days (`30d`).
 ### Backups
 
 `jarld backup` without a file name, which the `jarl-backup.timer` systemd
-timer runs daily, writes `jarl-<UTC time>.db` into `backup.dir` and then
-deletes old backups there. It reads these settings from this file each
+timer runs daily, writes `jarl-<UTC time>.db` into `backup.dir` (with the
+DNSSEC keys of signed zones inside it) and then deletes old backups there. It reads these settings from this file each
 time it runs; when it runs is the timer's (`systemctl edit
 jarl-backup.timer`). See [operations.md](operations.md#backups), also for
 restoring.
@@ -91,9 +91,10 @@ jarld restarts.
 |-----|---------|---------|
 | `bind.main_config` | `/etc/bind/named.conf` | The file named loads. `jarld import` reads it, and `jarld adopt` replaces it with an include of Jarl's configuration. |
 | `bind.config_dir` | `/etc/bind/jarl` | Where Jarl writes `named.conf` and `keys.conf`. Must be readable by named. |
-| `bind.zone_dir` | `/var/lib/bind/jarl` | Primary zone files (`<view>/<zone>.zone`). named may write journals here. |
+| `bind.zone_dir` | `/var/lib/bind/jarl` | Primary zone files (`<view>/<zone>.zone`). named may write journals, signed copies of zones and, under `dnssec-keys/`, DNSSEC keys here. |
 | `bind.cache_dir` | `/var/cache/bind/jarl` | Where named stores secondary, stub and mirror zones. |
 | `bind.file_group` | `bind` | Group given to generated files and directories so named can read them. Empty leaves the group alone. |
+| `bind.named_user` | `bind` | The user named runs as. `jarld restore` gives it the DNSSEC keys it puts back. |
 | `bind.named_checkconf` | `/usr/bin/named-checkconf` | Used to check every candidate configuration (`-z` also loads the zones). |
 | `bind.named_checkzone` | `/usr/bin/named-checkzone` | Used to check zone files. |
 | `bind.rndc` | `/usr/sbin/rndc` | Used to reconfigure and reload named and to read zone serials. |
@@ -111,6 +112,26 @@ there (`ReadWritePaths`). If you change them, update both
 ReadWritePaths=/srv/bind/jarl /srv/bind/zones
 ```
 
+### Porkbun (registrar)
+
+With an API key, Jarl can show and set a domain's name servers, glue
+records and DNSSEC DS records at Porkbun, after checking that the change
+won't break the domain ([dnssec.md](dnssec.md#porkbun)). Without a key
+(the default) nothing about Porkbun shows up.
+
+| Key | Default | Meaning |
+|-----|---------|---------|
+| `porkbun.api_key` | `""` | The API key (`pk1_...`). Set both or neither. |
+| `porkbun.secret_api_key` | `""` | Its secret (`sk1_...`). |
+| `porkbun.domains` | `[]` | Only these domains (default: every primary zone the key can reach). |
+
+The key can move your domain anywhere, so it is only ever read from this
+file: it isn't stored in the database or backups, and there is no API to
+set it. Keep the file readable only by root and jarld (`chown root:jarl
+jarl.yaml; chmod 640 jarl.yaml`, as the Debian package installs it); jarld
+warns at start when everyone can read it. At porkbun.com, switch on "API
+Access" for the domain, and limit the key to the domain if you can.
+
 ## Example: management network with TLS
 
 ```yaml