Registrar: only for zones that are a registered domain

With porkbun.domains empty the Registrar tab was offered for every zone
and always failed for subdomain zones, reverse zones and private names.
dnsname.RegisteredDomain (public suffix list) now decides; the others
get a message naming what delegates them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/configuration.md

@@ -163,7 +163,7 @@ check` says so).
 |-----|---------|---------|
 | `porkbun.api_key` | `""` | The API key (`pk1_...`). Set both or neither. |
 | `porkbun.secret_api_key` | `""` | Its secret (`sk1_...`). |
-| `porkbun.domains` | `[]` | Only these domains, for both uses (default: any domain the key can reach). |
+| `porkbun.domains` | `[]` | Only these domains, for both uses (default: any domain the key can reach). Subdomain and reverse zones never get the registrar features ([dnssec.md](dnssec.md#porkbun)). |
 
 The key can move your domain anywhere, so it is only ever read from this
 file: it isn't stored in the database or backups, and there is no API to

docs/dnssec.md

@@ -204,6 +204,18 @@ root:jarl`, `chmod 640`, as the package installs it); jarld warns at start
 when everyone can read it. Only administrators can use the registrar
 features.
 
+Only a zone that is a registered domain gets the registrar features
+(`adbraun.lol`, `example.co.uk`, judged by the public suffix list). Their
+parent zone delegates the others, not a registrar:
+
+* a subdomain zone such as `lab.adbraun.lol`: the NS and DS records in
+  `adbraun.lol`;
+* a reverse zone: whoever holds the addresses (your ISP, or the RIR);
+* a zone under a suffix that isn't public (`home.lan`, `home.arpa`):
+  nobody.
+
+The zone's **Name servers** tab (Check delegation) checks all of them.
+
 **Using it**: the zone's **Registrar** tab, or `jarl zone registrar`:
 
 | | |