Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/model/model.go

@@ -232,6 +232,9 @@ type State struct {
 	Zones    map[int64]*Zone
 	Records  map[int64]*Record
 	Options  map[int64]*Option
+	// Blocking (docs/blocking.md).
+	Blocklists map[int64]*Blocklist
+	BlockRules map[int64]*BlockRule
 }
 
 // NewState returns an empty state with default settings.
@@ -244,6 +247,9 @@ func NewState() *State {
 		Zones:    map[int64]*Zone{},
 		Records:  map[int64]*Record{},
 		Options:  map[int64]*Option{},
+
+		Blocklists: map[int64]*Blocklist{},
+		BlockRules: map[int64]*BlockRule{},
 	}
 }
 
@@ -257,6 +263,9 @@ func (s *State) Clone() *State {
 		Zones:    make(map[int64]*Zone, len(s.Zones)),
 		Records:  make(map[int64]*Record, len(s.Records)),
 		Options:  make(map[int64]*Option, len(s.Options)),
+
+		Blocklists: make(map[int64]*Blocklist, len(s.Blocklists)),
+		BlockRules: make(map[int64]*BlockRule, len(s.BlockRules)),
 	}
 	c.Settings.Nameservers = append([]string(nil), s.Settings.Nameservers...)
 	for id, v := range s.Views {
@@ -294,6 +303,16 @@ func (s *State) Clone() *State {
 		n := *o
 		c.Options[id] = &n
 	}
+	for id, b := range s.Blocklists {
+		n := *b
+		n.ViewIDs = append([]int64(nil), b.ViewIDs...)
+		c.Blocklists[id] = &n
+	}
+	for id, r := range s.BlockRules {
+		n := *r
+		n.ViewIDs = append([]int64(nil), r.ViewIDs...)
+		c.BlockRules[id] = &n
+	}
 	return c
 }