Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/inputs.go

@@ -30,6 +30,13 @@ const (
 	OpOptionDelete   = "option.delete"
 	OpSettingsUpdate = "settings.update"
 
+	OpBlocklistCreate = "blocklist.create"
+	OpBlocklistUpdate = "blocklist.update"
+	OpBlocklistDelete = "blocklist.delete"
+	OpBlockRuleCreate = "blockrule.create"
+	OpBlockRuleUpdate = "blockrule.update"
+	OpBlockRuleDelete = "blockrule.delete"
+
 	// Requests only: disabling and enabling records, by ID or by match
 	// (zone, name, type and optionally data), become record.update
 	// operations.
@@ -40,7 +47,8 @@ const (
 // OpKinds lists all operation kinds.
 var OpKinds = []string{OpZoneCreate, OpZoneUpdate, OpZoneDelete, OpRecordCreate, OpRecordUpdate, OpRecordDelete, OpRRSetReplace,
 	OpViewCreate, OpViewUpdate, OpViewDelete, OpViewReorder, OpACLCreate, OpACLUpdate, OpACLDelete,
-	OpTSIGCreate, OpTSIGUpdate, OpTSIGDelete, OpOptionCreate, OpOptionUpdate, OpOptionDelete, OpSettingsUpdate}
+	OpTSIGCreate, OpTSIGUpdate, OpTSIGDelete, OpOptionCreate, OpOptionUpdate, OpOptionDelete, OpSettingsUpdate,
+	OpBlocklistCreate, OpBlocklistUpdate, OpBlocklistDelete, OpBlockRuleCreate, OpBlockRuleUpdate, OpBlockRuleDelete}
 
 // Request is an operation as submitted by a client. Requests are expanded
 // into one or more stored operations (for example an A record with "ptr"
@@ -213,3 +221,26 @@ type SettingsInput struct {
 type DeleteInput struct {
 	Cascade bool `json:"cascade,omitempty"`
 }
+
+// BlocklistInput creates or updates a blocklist. Views are given by name
+// (Views) or ID (ViewIDs); an empty list means every view that offers
+// recursion.
+type BlocklistInput struct {
+	Name     *string   `json:"name,omitempty"`
+	URL      *string   `json:"url,omitempty"`
+	Views    *[]string `json:"views,omitempty"`
+	ViewIDs  *[]int64  `json:"view_ids,omitempty"`
+	Disabled *bool     `json:"disabled,omitempty"`
+	Comment  *string   `json:"comment,omitempty"`
+}
+
+// BlockRuleInput creates or updates a block or allow rule. Views as for
+// BlocklistInput.
+type BlockRuleInput struct {
+	Name    *string   `json:"name,omitempty"`
+	Action  *string   `json:"action,omitempty"` // block (default) or allow
+	Exact   *bool     `json:"exact,omitempty"`  // only the name, not the names below it
+	Views   *[]string `json:"views,omitempty"`
+	ViewIDs *[]int64  `json:"view_ids,omitempty"`
+	Comment *string   `json:"comment,omitempty"`
+}