Disable zones instead of deleting them

A disabled zone stays in Jarl with its records, options and history,
still editable, but named doesn't load it; enabling it serves it as it is
then. Signed zones, and zones another view shares, can't be disabled.
jarl zone disable|enable, the zone page's Disable/Enable button.
Database schema 7.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -8,6 +8,14 @@ All notable changes to Jarl are documented here. The format follows
 
 ### Added
 
+- Disabled zones: a zone can be disabled instead of deleted. named stops
+  loading it (its zone statement is left out of named.conf), while Jarl
+  keeps it with its records, options and history, still editable;
+  enabling it serves it as it is then. Disabling says what clients get
+  instead (recursion, or REFUSED). Signed zones can't be disabled. Web
+  UI: Disable/Enable on the zone page, a badge in the zone list. CLI:
+  `jarl zone disable|enable`. API: `PATCH /zones/{zone}` with
+  `{"disabled": true}`. Database schema 7.
 - Blocking (docs/blocking.md): named answers "doesn't exist" for ads,
   trackers and malware, using BIND's response policy zones.
   - Blocklists in Adblock, hosts or plain-domain format, downloaded by jarld