Fix the dashboard's pending-changes count; explain zones in the docs

The dashboard counted every open changeset, including empty ones and
other users', so "Pending changes (1 open)" led to an empty Changes page.
It now counts the user's own changesets that contain changes, the status
API's open_changesets skips empty ones, and in review mode a draft created
for an edit the server rejects is discarded instead of left open.

docs/concepts.md: zone types, a new zone's name servers and glue, reverse
zones for any network, and dynamic updates versus API tokens and TSIG keys.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -24,6 +24,9 @@ The first version, to be released as 0.1.0.
   the web UI. Networks smaller than a /24 explain that they belong in the
   enclosing /24's zone.
 - docs/operations.md: setting up a secondary server with its own jarld.
+- docs/concepts.md: what each zone type does, what to enter as a new zone's
+  name servers (and when glue addresses are needed), how reverse zones map
+  to networks, and why dynamic updates give way to API tokens.
 
 - A logo: a Viking jarl drawn like a woodcut, with a spear-pointed crown
   that holds a DNS tree (a root node and its branches), a stern face and a
@@ -163,6 +166,12 @@ The first version, to be released as 0.1.0.
 
 ### Fixed
 
+- The dashboard's "Pending changes (1 open)" counted empty changesets (and
+  other users'), so the Changes page then showed none. It now counts your
+  own changesets that contain changes, and the status API's
+  `open_changesets` only counts non-empty ones. In review mode, a draft
+  created for an edit that the server rejects is discarded instead of
+  being left open and empty.
 - Under the shipped systemd unit (`RestrictSUIDSGID=yes`), the first zone
   in a new view failed with "chmod /var/lib/bind/jarl/VIEW: operation not
   permitted": setting the setgid bit on the new directory is refused there.