Disable zones instead of deleting them

A disabled zone stays in Jarl with its records, options and history,
still editable, but named doesn't load it; enabling it serves it as it is
then. Signed zones, and zones another view shares, can't be disabled.
jarl zone disable|enable, the zone page's Disable/Enable button.
Database schema 7.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/model/model.go

@@ -128,6 +128,9 @@ type Zone struct {
 	// signing is being removed safely (docs/dnssec.md).
 	DNSSECPolicy string `json:"dnssec_policy,omitempty"`
 	Comment      string `json:"comment"`
+	// Disabled zones stay in Jarl, records and all, but named doesn't
+	// load them: their zone statement is left out of named.conf.
+	Disabled bool `json:"disabled,omitempty"`
 	Meta
 }