Disable zones instead of deleting them

A disabled zone stays in Jarl with its records, options and history,
still editable, but named doesn't load it; enabling it serves it as it is
then. Signed zones, and zones another view shares, can't be disabled.
jarl zone disable|enable, the zone page's Disable/Enable button.
Database schema 7.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_acme.go

@@ -157,7 +157,7 @@ func primaryZonesFor(st *model.State, p *auth.Principal) []acme.Zone {
 	var out []acme.Zone
 	for _, z := range st.SortedZones() {
 		vn := st.ViewName(z)
-		if z.Type == model.ZonePrimary && p.CanSeeZone(z.Name, vn) {
+		if z.Type == model.ZonePrimary && !z.Disabled && p.CanSeeZone(z.Name, vn) {
 			out = append(out, acme.Zone{Name: z.Name, View: vn})
 		}
 	}