Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/ops.go

@@ -98,6 +98,14 @@ func applyOp(st *model.State, op model.Op, c *applyCtx) error {
 		err = applyOptionDelete(st, op, c)
 	case OpSettingsUpdate:
 		err = applySettings(st, op, c)
+	case OpBlocklistCreate, OpBlocklistUpdate:
+		err = applyBlocklistPut(st, op, c)
+	case OpBlocklistDelete:
+		err = applyBlocklistDelete(st, op, c)
+	case OpBlockRuleCreate, OpBlockRuleUpdate:
+		err = applyBlockRulePut(st, op, c)
+	case OpBlockRuleDelete:
+		err = applyBlockRuleDelete(st, op, c)
 	default:
 		err = errf(KindBadRequest, "unknown operation %q", op.Kind)
 	}
@@ -831,6 +839,9 @@ func applyViewDelete(st *model.State, op model.Op, c *applyCtx) error {
 	if err := decode(op.Data, &in); err != nil {
 		return err
 	}
+	if users := blockingUsers(st, v.ID); len(users) > 0 {
+		return errf(KindConflict, "view %s is used by %s; change them to other views first", v.Name, strings.Join(users, ", "))
+	}
 	zones := st.ZonesInView(v.ID)
 	if len(zones) > 0 && !in.Cascade {
 		var names []string