Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/expand.go

@@ -222,6 +222,30 @@ func (x *expander) expand(req Request) ([]model.Op, error) {
 		return []model.Op{x.versioned(req, o.Version, summary)}, nil
 	case OpSettingsUpdate:
 		return []model.Op{newOpRaw(OpSettingsUpdate, 0, 0, req.Data, "update settings")}, nil
+	case OpBlocklistCreate:
+		return x.blocklistCreate(req)
+	case OpBlocklistUpdate, OpBlocklistDelete:
+		b := x.st.Blocklists[req.ID]
+		if b == nil {
+			return nil, errf(KindNotFound, "blocklist %d does not exist", req.ID)
+		}
+		verb := "change"
+		if req.Op == OpBlocklistDelete {
+			verb = "delete"
+		}
+		return []model.Op{x.versioned(req, b.Version, verb+" blocklist "+b.Name)}, nil
+	case OpBlockRuleCreate:
+		return x.blockRuleCreate(req)
+	case OpBlockRuleUpdate, OpBlockRuleDelete:
+		r := x.st.BlockRules[req.ID]
+		if r == nil {
+			return nil, errf(KindNotFound, "rule %d does not exist", req.ID)
+		}
+		verb := "change rule: "
+		if req.Op == OpBlockRuleDelete {
+			verb = "delete rule: "
+		}
+		return []model.Op{x.versioned(req, r.Version, verb+ruleLabel(r))}, nil
 	}
 	return nil, errf(KindBadRequest, "unknown operation %q", req.Op)
 }