Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,35 @@ All notable changes to Jarl are documented here. The format follows
 
 ## [Unreleased]
 
+### Added
+
+- Blocking (docs/blocking.md): named answers "doesn't exist" for ads,
+  trackers and malware, using BIND's response policy zones.
+  - Blocklists in Adblock, hosts or plain-domain format, downloaded by jarld
+    and checked daily (`blocking.refresh`). A list is downloaded only when
+    the server says it changed, checked with named-checkzone, and reloaded
+    only when its content differs; a failed update keeps the previous
+    version and shows on the dashboard.
+  - Your own block and allow rules, for a domain and the names below it or
+    the exact name. Rules take precedence over every list, and the most
+    specific rule wins.
+  - Lists and rules apply to chosen views, or to every view that offers
+    recursion. They are configuration: staged, reviewed and reverted like
+    any change.
+  - Checking a name says whether it is blocked and by which rule or list
+    entry, with an Allow button in the web UI.
+  - Web UI: a Blocking page, with well-known lists to pick and named's
+    memory per list. CLI: `jarl blocklist` and `jarl block`. API:
+    `/blocking/lists`, `/blocking/rules`, `/blocking/check`.
+  - Statistics: blocked queries and their share, blocked per list, most
+    blocked names (`jarl stats top blocked`). Blocked answers no longer
+    count as names that don't exist.
+  - A `blocking` permission; database schema 6.
+
+### Fixed
+
+- docs/validation.md lacked the `disabled_conflict` warning added in 0.3.0.
+
 ## [0.3.0] - 2026-10-09
 
 ### Added