Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/diffops.go

@@ -101,7 +101,35 @@ func DiffOps(from, to *model.State) []model.Op {
 			add(OpRecordUpdate, k, o.Version, in, fmt.Sprintf("restore %s %s %s", n.Name, n.Type, n.Data))
 		}
 	}
+	for _, k := range sortedKeys(to.Blocklists) {
+		n := to.Blocklists[k]
+		in := BlocklistInput{Name: &n.Name, URL: &n.URL, ViewIDs: model.Ptr(append([]int64{}, n.ViewIDs...)), Disabled: &n.Disabled, Comment: &n.Comment}
+		if o, ok := from.Blocklists[k]; !ok {
+			add(OpBlocklistCreate, k, 0, in, "add blocklist "+n.Name)
+		} else if !sameObject(o, n) {
+			add(OpBlocklistUpdate, k, o.Version, in, "restore blocklist "+n.Name)
+		}
+	}
+	for _, k := range sortedKeys(to.BlockRules) {
+		n := to.BlockRules[k]
+		in := BlockRuleInput{Name: &n.Name, Action: &n.Action, Exact: &n.Exact, ViewIDs: model.Ptr(append([]int64{}, n.ViewIDs...)), Comment: &n.Comment}
+		if o, ok := from.BlockRules[k]; !ok {
+			add(OpBlockRuleCreate, k, 0, in, "add rule: "+ruleLabel(n))
+		} else if !sameObject(o, n) {
+			add(OpBlockRuleUpdate, k, o.Version, in, "restore rule: "+ruleLabel(n))
+		}
+	}
 	// Deletions, most dependent objects first.
+	for _, k := range sortedKeys(from.BlockRules) {
+		if _, ok := to.BlockRules[k]; !ok {
+			add(OpBlockRuleDelete, k, from.BlockRules[k].Version, nil, "delete rule: "+ruleLabel(from.BlockRules[k]))
+		}
+	}
+	for _, k := range sortedKeys(from.Blocklists) {
+		if _, ok := to.Blocklists[k]; !ok {
+			add(OpBlocklistDelete, k, from.Blocklists[k].Version, nil, "delete blocklist "+from.Blocklists[k].Name)
+		}
+	}
 	for _, k := range sortedKeys(from.Records) {
 		if _, ok := to.Records[k]; !ok {
 			o := from.Records[k]