Add DNSSEC signing, key backups and Porkbun support

Zones get a DNSSEC setting: named signs them with BIND's default (or a
custom) dnssec-policy and inline signing, with keys in a per-view key
directory. Jarl shows the keys, the DS record and when it is safe to
publish it, checks the parent's DS records (check-ds, which also tells
named), and refuses steps that would break a signed domain: switching
straight to unsigned, finishing a turn-off too early, deleting or moving
a signed zone, TTLs above max-zone-ttl. Turning off goes through the
insecure policy; wipe starts over once the parent has no DS.

Backups store the DNSSEC keys and restore puts them back for named; the
backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's
serial above named's whenever it writes an older one (after a restore).
The serials check compares the signed serial.

With a Porkbun API key in jarl.yaml, the registrar's name servers, glue
records and DS records can be shown and changed, each change checked
first (dry run, force to override).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -24,8 +24,10 @@ internal/
   web/static/         the web UI: plain ES modules, no build step, embedded with go:embed
   api/, client/       JSON types and the Go client shared by server and CLI
   acme/               ACME DNS-01 challenge records, shared by jarl acme and the httpreq endpoint
-  backup/             database backups: write (VACUUM INTO) and check, list, prune by the time in the name
-  nscheck/            DNS queries to other name servers: zone serials and the parent's delegation
+  backup/             database backups: write (VACUUM INTO, plus the DNSSEC key files) and check, list, prune by the time in the name
+  nscheck/            DNS queries to other name servers: zone serials, the parent's delegation and DS records
+  dnssec/             reads named's DNSSEC key and state files; DS records; the signing phases (docs/dnssec.md)
+  porkbun/            Porkbun API client (name servers, glue, DS records) and an in-memory fake for tests
   config/             jarld's YAML configuration
 deploy/               systemd units (jarld, the daily backup service and timer), sysusers.d and tmpfiles.d files
 deploy/debian/        the Debian package's control template and postinst/prerm/postrm
@@ -110,7 +112,10 @@ checker tests work with the installed `bind9-utils` too.
 `scripts/e2e.sh` builds a legacy BIND setup, starts named, runs
 `jarld init`, `import`, `adopt` and `serve`, then drives every CLI command
 (records, batches, changesets, views, ACLs, TSIG, options, users, tokens,
-ACME hooks, audit) and checks the answers with `dig`. `KEEP=1` leaves named
+ACME hooks, DNSSEC signing, backup and restore with keys, audit) and checks
+the answers with `dig`. The Porkbun code is tested against
+`porkbun.Fake`, an in-memory stand-in for its API; nothing calls the real
+one. `KEEP=1` leaves named
 and jarld running afterwards. The output says where; set `JARL_CLI_CONFIG`
 to that directory's `cli.yaml` to keep using the CLI against it.