Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/configuration.md

@@ -134,6 +134,17 @@ jarl.yaml; chmod 640 jarl.yaml`, as the Debian package installs it); jarld
 warns at start when everyone can read it. At porkbun.com, switch on "API
 Access" for the domain, and limit the key to the domain if you can.
 
+### Blocking
+
+How jarld downloads blocklists ([blocking.md](blocking.md)). The lists and
+rules themselves are configuration in the database.
+
+| Key | Default | Meaning |
+|-----|---------|---------|
+| `blocking.refresh` | `24h` | How often each blocklist is checked for changes (at least `1h`); it is downloaded only when it changed ([blocking.md](blocking.md)). |
+| `blocking.max_download_mb` | `64` | Larger downloads are refused (the previous version stays in use). |
+| `blocking.max_entries` | `1000000` | Lists with more domains are refused. |
+
 ## Example: management network with TLS
 
 ```yaml