Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -419,15 +419,33 @@ working.
 ```sh
 jarl stats status
 jarl stats summary --since 7d
-jarl stats top names | clients | nxdomain | servfail | refused [--since 24h] [--limit 20]
+jarl stats top names | clients | nxdomain | servfail | refused | blocked [--since 24h] [--limit 20]
 jarl stats timeline --since 6h [--key rcode:NXDOMAIN] [--table]
 jarl stats heatmap --since 28d
-jarl stats breakdown qtype | rcode | view | zone | answer | rtt
+jarl stats breakdown qtype | rcode | view | zone | answer | rtt | blocklist
 ```
 
 Statistics must be enabled in `jarl.yaml`, and `-o json` exports the data.
 See [stats.md](stats.md).
 
+## Blocking
+
+```sh
+jarl blocklist list
+jarl blocklist add NAME URL [--view V]...         # default: every view that offers recursion
+jarl blocklist update NAME [--url U] [--name N] [--view V | --view auto] [--comment C]
+jarl blocklist disable | enable | delete NAME
+jarl blocklist refresh [NAME...] [--force]       # download now (all lists without NAME)
+
+jarl block add DOMAIN [--exact] [--view V]...    # block it (and the names below it)
+jarl block allow DOMAIN [--exact] [--view V]...  # an exception that beats every list
+jarl block list
+jarl block delete DOMAIN [--view V] | --id ID
+jarl block check DOMAIN                          # blocked? by which rule or list?
+```
+
+See [blocking.md](blocking.md).
+
 ## ACME DNS-01
 
 ```sh