Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/validation.md

@@ -30,6 +30,7 @@ showing them.
 | `record_out_of_zone` | error | The name must be inside the zone (catches `www.example.com` without the final dot) |
 | `record_duplicate` | error | The same record can't exist twice |
 | `cname_conflict` | error | A CNAME must be the only record at its name (RFC 1034), so no CNAME next to A, MX, TXT... |
+| `disabled_conflict` | warning | A disabled record that couldn't be enabled again as the zone is now (a CNAME now shares its name) |
 | `cname_multiple` | error | A name can have only one CNAME |
 | `cname_apex` | error | No CNAME at the zone apex (it needs SOA and NS) |
 | `cname_loop` | error | CNAMEs that point back to themselves |
@@ -100,6 +101,19 @@ applied.
 | `dnssec_old_keys` | info | Signing a zone whose key directory still has old keys |
 | `serial_not_higher` | error | An explicit serial on a signed zone must be above the one named has loaded (automatic serials are raised by themselves) |
 
+## Blocking
+
+From [blocking.md](blocking.md).
+
+| Code | Severity | Rule |
+|------|----------|------|
+| `blocking_rule_duplicate` | error | One rule per domain and view |
+| `blocking_response_policy` | error | No `response-policy` option where Jarl's blocking writes that statement (the view, or the server) |
+| `zone_name_reserved` | error | Zone names under `jarl.invalid` are reserved for blocking's policy zones |
+| `blocking_view_missing` | error | A list or rule names a view that doesn't exist |
+| `blocking_no_view` | warning | A list or rule applies to no view: none offers recursion, and blocking only changes recursive answers |
+| `blocking_no_recursion` | warning | A list or rule names a view that doesn't offer recursion, where it has no effect |
+
 ## Security lints
 
 | Code | Severity | What it catches |