Add DNSSEC signing, key backups and Porkbun support

Zones get a DNSSEC setting: named signs them with BIND's default (or a
custom) dnssec-policy and inline signing, with keys in a per-view key
directory. Jarl shows the keys, the DS record and when it is safe to
publish it, checks the parent's DS records (check-ds, which also tells
named), and refuses steps that would break a signed domain: switching
straight to unsigned, finishing a turn-off too early, deleting or moving
a signed zone, TTLs above max-zone-ttl. Turning off goes through the
insecure policy; wipe starts over once the parent has no DS.

Backups store the DNSSEC keys and restore puts them back for named; the
backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's
serial above named's whenever it writes an older one (after a restore).
The serials check compares the signed serial.

With a Porkbun API key in jarl.yaml, the registrar's name servers, glue
records and DS records can be shown and changed, each change checked
first (dry run, force to override).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/style.css

@@ -243,6 +243,13 @@ button:disabled { opacity: 0.5; cursor: not-allowed; }
 .grants { font-family: var(--mono); font-size: 12px; }
 .copy-box { display: flex; gap: 6px; align-items: center; }
 .copy-box input { flex: 1; font-family: var(--mono); }
+.ds-record { margin: 12px 0 16px; }
+.ds-record > .copy-box { max-width: 900px; }
+.ds-record .kv { margin-top: 8px; align-items: center; grid-template-columns: max-content minmax(0, 1fr); }
+.ds-record .kv dd { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; min-width: 0; }
+.ds-record .kv dd .copy-box { flex: 1 1 200px; max-width: 640px; min-width: 0; }
+.copy-box input { min-width: 0; }
+td.break { word-break: break-all; }
 .sortable-row { display: flex; align-items: center; gap: 8px; }
 @media (max-width: 700px) {
   .form-grid { grid-template-columns: 1fr; }