Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/render/render.go

@@ -69,6 +69,11 @@ type Output struct {
 	Spans map[string][]Span
 	// ZoneFiles maps zone IDs to the file named loads for the zone.
 	ZoneFiles map[int64]string
+	// Policy lists the response policy zones (docs/blocking.md).
+	Policy []PolicyZone
+	// Blocklists are the zone files of blocklists named loads. jarld
+	// downloads them; until then they must exist, as empty policy zones.
+	Blocklists []string
 }
 
 // File returns the rendered file at path, or nil.
@@ -264,6 +269,9 @@ func renderConfig(s *model.State, p Paths, x Extras, out *Output) (string, []Spa
 
 	st := x.Stats
 	logResponses := st != nil && st.LogFile != ""
+	pzs := PolicyZones(s, p)
+	out.Policy = pzs
+	logRewrites := logResponses && len(pzs) > 0
 	sawStats, sawLogging := false, false
 	if top := s.ScopedOptions(model.ScopeTopLevel, 0); len(top) > 0 {
 		w.write("\n")
@@ -274,7 +282,7 @@ func renderConfig(s *model.State, p Paths, x Extras, out *Output) (string, []Spa
 				w.write(st.statsStatement(o))
 				sawStats = true
 			case logResponses && o.Name == "logging" && !sawLogging:
-				w.write(st.loggingStatement(o))
+				w.write(st.loggingStatement(o, logRewrites))
 				sawLogging = true
 			default:
 				w.write(optionText(o, 0))
@@ -289,7 +297,7 @@ func renderConfig(s *model.State, p Paths, x Extras, out *Output) (string, []Spa
 			w.write(st.statsStatement(nil))
 		}
 		if logResponses && !sawLogging {
-			w.write(st.loggingStatement(nil))
+			w.write(st.loggingStatement(nil, logRewrites))
 		}
 		w.end()
 	}
@@ -322,10 +330,14 @@ func renderConfig(s *model.State, p Paths, x Extras, out *Output) (string, []Spa
 		w.write("\t// " + statsComment + "\n\tresponselog yes;\n")
 		w.end()
 	}
-	w.write("};\n")
-
 	views := s.OrderedViews()
 	if len(views) == 0 {
+		writeResponsePolicy(w, scopeZones(pzs, 0), logResponses)
+	}
+	w.write("};\n")
+
+	if len(views) == 0 {
+		writePolicyZones(w, s, scopeZones(pzs, 0), out, 0)
 		for _, z := range s.ZonesInView(0) {
 			w.write("\n")
 			renderZone(w, s, z, p, out, 0)
@@ -352,6 +364,8 @@ func renderConfig(s *model.State, p Paths, x Extras, out *Output) (string, []Spa
 			w.write(optionText(o, 1))
 			w.end()
 		}
+		writeResponsePolicy(w, scopeZones(pzs, v.ID), logResponses)
+		writePolicyZones(w, s, scopeZones(pzs, v.ID), out, 1)
 		for _, z := range s.ZonesInView(v.ID) {
 			w.write("\n")
 			renderZone(w, s, z, p, out, 1)