DNS over TLS and HTTPS set up in one step

jarl encrypted-dns setup (and the Encrypted DNS page) finds or obtains a
certificate for the host name, checks that nothing else listens on the
DoT and DoH ports at the chosen addresses (offering a free DoH port), and
stages named's tls statement and listeners as one change, keeping port 53
where it was when there was no listen-on, plus the host name's records in
the private views (local to the view in a linked zone). Status shows what
to give Android, Linux, Firefox, Chrome and Windows clients. A tls
statement with missing files is refused (tls_file_missing), and a
certificate named uses can't be deleted. docs/encrypted-dns.md, e2e with
real DoT and DoH queries.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/app.js

@@ -20,6 +20,7 @@ import * as stats from "./pages/stats.js";
 import * as blocking from "./pages/blocking.js";
 import * as exposure from "./pages/exposure.js";
 import * as certificates from "./pages/certificates.js";
+import * as encdns from "./pages/encdns.js";
 
 const routes = [
   { pattern: /^$/, page: dashboard, nav: "dashboard" },
@@ -41,6 +42,7 @@ const routes = [
   { pattern: /^blocking$/, page: blocking, nav: "blocking" },
   { pattern: /^exposure$/, page: exposure, nav: "exposure" },
   { pattern: /^certificates$/, page: certificates, nav: "certificates" },
+  { pattern: /^encrypted-dns$/, page: encdns, nav: "encdns" },
 ];
 
 const navItems = [
@@ -51,6 +53,7 @@ const navItems = [
   ["views", "#/views", "Views"],
   ["exposure", "#/exposure", "Exposure"],
   ["certificates", "#/certificates", "Certificates", "admin"],
+  ["encdns", "#/encrypted-dns", "Encrypted DNS", "admin"],
   ["acls", "#/acls", "ACLs"],
   ["keys", "#/keys", "TSIG keys"],
   ["options", "#/options", "Server options"],