Disable zones instead of deleting them

A disabled zone stays in Jarl with its records, options and history,
still editable, but named doesn't load it; enabling it serves it as it is
then. Signed zones, and zones another view shares, can't be disabled.
jarl zone disable|enable, the zone page's Disable/Enable button.
Database schema 7.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -182,12 +182,21 @@ jarl zone create consul --type forward --forwarder "127.0.0.1 port 8600"
 jarl zone update adbraun.lol --ttl 3600 --contact hostmaster@adbraun.lol --refresh 7200
 jarl zone update adbraun.lol --move-to-view internal
 jarl zone delete lab.adbraun.lol [-y]
+jarl zone disable lab.adbraun.lol [--view V]   # named stops serving it; kept (and editable) in Jarl
+jarl zone enable lab.adbraun.lol [--view V]
 jarl zone file adbraun.lol                             # the generated zone file
 jarl zone import adbraun.lol db.adbraun.lol [--replace] [--use-soa]
 jarl zone serials adbraun.lol                          # are the secondaries (or primaries) on the current serial?
 jarl zone delegation adbraun.lol [--resolver 9.9.9.9]  # does the parent zone delegate it correctly?
 ```
 
+**Disabling a zone** leaves it out of named's configuration but keeps it in
+Jarl: records, options and history, which can still be edited. Its names
+are then answered by recursion where the view offers it (the internet's
+version of the zone, if any), and REFUSED elsewhere; `disable` says which.
+Enabling it serves it as it is then. A signed zone can't be disabled (turn
+signing off first), nor a zone another view shares with `in-view`.
+
 Reverse names follow the dots (the nibbles in IPv6), so a reverse zone
 covers a /8, /16 or /24 (a multiple of /4 for IPv6). A network in between is
 covered by several zones, created together in one changeset: a /22 by four