Different blocking for different devices: steps and client groups

Client groups put devices (addresses, networks, or ACLs of them) at a
blocking step: off (only your rules), normal (the default), or steps
added above it, each including the lists of the steps below. Lists
start at a step. In each view, a gate policy zone in front of a step's
lists lets the devices below that step through (rpz-client-ip triggers
with rpz-passthru), so every list is still loaded once. The IPv6 part
of a gate leaves the IPv4-mapped range out: named matches IPv4 clients
as ::ffff:a.b.c.d.

Web UI: a Devices panel on the Blocking page and a step on each list.
CLI: jarl block step, jarl block group, jarl blocklist --step. API:
/blocking/steps, /blocking/groups. Database schema 8.

Also: copying the state kept empty lists as empty (not nil), so
reverting a changeset no longer adds restore operations for unchanged
blocklists, rules and views.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/blocklists.go

@@ -335,7 +335,9 @@ func (l *limitedReader) Read(p []byte) (int, error) {
 
 // CheckBlocking reports, for every view with blocking, whether name is
 // blocked or allowed there, and by which rule or list. It looks names up
-// the way named does: rules first, then the lists in order.
+// the way named does: rules first, then the lists in order. The answer is
+// for clients at the normal step; a list of a higher step that blocks the
+// name says so (Match.Step), and clients at step off skip every list.
 func (e *Engine) CheckBlocking(st *model.State, name string) ([]blocking.Match, error) {
 	n, err := blocking.NormalizeName(name)
 	if err != nil {
@@ -349,8 +351,8 @@ func (e *Engine) CheckBlocking(st *model.State, name string) ([]blocking.Match,
 			out = append(out, blocking.Match{View: z.View, Result: "none"})
 			cur = &out[len(out)-1]
 		}
-		if cur.Result != "none" {
-			continue // an earlier zone decided
+		if cur.Result != "none" || z.IsGate() {
+			continue // an earlier zone decided, or a gate (it never blocks)
 		}
 		if z.ListID == 0 {
 			owner, act, ok := blocking.MatchRules(blocking.RuleEntries(render.ViewRules(st, z.ViewID)), n)
@@ -372,7 +374,11 @@ func (e *Engine) CheckBlocking(st *model.State, name string) ([]blocking.Match,
 			feeds[z.File] = entry
 		}
 		if entry != "" {
-			cur.Result, cur.Entry, cur.List = "blocked", entry, st.Blocklists[z.ListID].Name
+			b := st.Blocklists[z.ListID]
+			cur.Result, cur.Entry, cur.List = "blocked", entry, b.Name
+			if b.StepID != model.StepNormal {
+				cur.Step = st.StepName(b.StepID)
+			}
 		}
 	}
 	return out, nil