Add DNSSEC signing, key backups and Porkbun support

Zones get a DNSSEC setting: named signs them with BIND's default (or a
custom) dnssec-policy and inline signing, with keys in a per-view key
directory. Jarl shows the keys, the DS record and when it is safe to
publish it, checks the parent's DS records (check-ds, which also tells
named), and refuses steps that would break a signed domain: switching
straight to unsigned, finishing a turn-off too early, deleting or moving
a signed zone, TTLs above max-zone-ttl. Turning off goes through the
insecure policy; wipe starts over once the parent has no DS.

Backups store the DNSSEC keys and restore puts them back for named; the
backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's
serial above named's whenever it writes an older one (after a restore).
The serials check compares the signed serial.

With a Porkbun API key in jarl.yaml, the registrar's name servers, glue
records and DS records can be shown and changed, each change checked
first (dry run, force to override).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/bind/bind_test.go

@@ -17,3 +17,33 @@ zone example.com/IN/internal: loaded serial 1
 		t.Errorf("exit 1: %+v", bad)
 	}
 }
+
+func TestParseZoneStatusSigned(t *testing.T) {
+	// rndc zonestatus of a zone named signs with dnssec-policy (BIND 9.20).
+	zs := ParseZoneStatus(`name: example.test
+type: primary
+files: /var/lib/bind/jarl/_default/example.test.zone
+serial: 2026100802
+signed serial: 2026100804
+nodes: 4
+last loaded: Thu, 08 Oct 2026 19:03:31 GMT
+secure: yes
+inline signing: yes
+key maintenance: automatic
+next key event: Thu, 08 Oct 2026 21:08:31 GMT
+next resign node: new.example.test/A
+next resign time: Sat, 17 Oct 2026 07:32:59 GMT
+dynamic: no
+reconfigurable via modzone: no
+`)
+	if zs.Serial != 2026100802 || zs.SignedSerial != 2026100804 || !zs.Secure || !zs.InlineSigning || zs.NextKeyEvent != "Thu, 08 Oct 2026 21:08:31 GMT" {
+		t.Errorf("%+v", zs)
+	}
+	if s, ok := zs.ServedSerial(); !ok || s != 2026100804 {
+		t.Errorf("served serial %d %v", s, ok)
+	}
+	plain := ParseZoneStatus("name: example.com\nserial: 7\nsecure: no\n")
+	if s, ok := plain.ServedSerial(); !ok || s != 7 || plain.HasSignedSerial {
+		t.Errorf("unsigned: %+v", plain)
+	}
+}