Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/grants.go

@@ -12,19 +12,20 @@ import (
 
 // Resources that grants apply to.
 const (
-	ResZones   = "zones"   // zone definitions and zone options
-	ResRecords = "records" // records in zones
-	ResViews   = "views"   // views and view options
-	ResACLs    = "acls"
-	ResTSIG    = "tsig"    // TSIG keys
-	ResOptions = "options" // server options, top-level statements, settings
-	ResAudit   = "audit"   // audit log and everyone's changesets
-	ResStats   = "stats"   // query statistics
-	ResAll     = "*"
+	ResZones    = "zones"   // zone definitions and zone options
+	ResRecords  = "records" // records in zones
+	ResViews    = "views"   // views and view options
+	ResACLs     = "acls"
+	ResTSIG     = "tsig"     // TSIG keys
+	ResOptions  = "options"  // server options, top-level statements, settings
+	ResAudit    = "audit"    // audit log and everyone's changesets
+	ResStats    = "stats"    // query statistics
+	ResBlocking = "blocking" // blocklists and block/allow rules
+	ResAll      = "*"
 )
 
 // Resources lists the resources in display order.
-var Resources = []string{ResZones, ResRecords, ResViews, ResACLs, ResTSIG, ResOptions, ResAudit, ResStats}
+var Resources = []string{ResZones, ResRecords, ResViews, ResACLs, ResTSIG, ResOptions, ResAudit, ResStats, ResBlocking}
 
 // Access levels.
 const (
@@ -377,6 +378,7 @@ var RoleTemplates = map[string][]model.Grant{
 		{Resource: ResViews, Access: Read},
 		{Resource: ResACLs, Access: Read},
 		{Resource: ResOptions, Access: Read},
+		{Resource: ResBlocking, Access: Read},
 	},
 	"operator": {{Resource: ResAll, Access: Write}},
 	"acme":     {{Resource: ResRecords, Access: Write, Names: []string{"_acme-challenge.*"}, Types: []string{"TXT"}}},