Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/deploy.go

@@ -183,6 +183,48 @@ func (d *Deployer) writeAtomic(path string, content []byte, mode fs.FileMode) er
 	return nil
 }
 
+// writeNew creates a file that doesn't exist yet (fs.ErrExist if it
+// does), with the deploy group.
+func (d *Deployer) writeNew(path string, content []byte, mode fs.FileMode) error {
+	dir := filepath.Dir(path)
+	if err := d.EnsureDir(dir, d.dirMode(dir)); err != nil {
+		return err
+	}
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, mode)
+	if err != nil {
+		return err
+	}
+	_, err = f.Write(content)
+	if gid, gerr := d.groupID(); err == nil && gerr == nil && gid >= 0 {
+		err = f.Chown(-1, gid)
+	}
+	if cerr := f.Close(); err == nil {
+		err = cerr
+	}
+	if err != nil {
+		os.Remove(path)
+	}
+	return err
+}
+
+// finish gives a temporary file written next to path its mode and the
+// deploy group, and moves it into place.
+func (d *Deployer) finish(tmp, path string, mode fs.FileMode) error {
+	if err := os.Chmod(tmp, mode); err != nil {
+		return err
+	}
+	gid, err := d.groupID()
+	if err != nil {
+		return err
+	}
+	if gid >= 0 {
+		if err := os.Chown(tmp, -1, gid); err != nil {
+			return fmt.Errorf("chgrp %s: %w", path, err)
+		}
+	}
+	return os.Rename(tmp, path)
+}
+
 // Install writes files and removes paths, returning a backup that undoes
 // the changes. On error the files already written are restored.
 func (d *Deployer) Install(files []*render.File, remove []string, dirs []string) (*Backup, error) {