Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/routes.go

@@ -56,6 +56,19 @@ func (s *Server) routes() {
 	m.HandleFunc("DELETE "+p+"/views/{id}", s.authed(s.deleteView))
 	m.HandleFunc("PUT "+p+"/views/{id}/color", s.authed(s.setViewColor))
 	// ACLs
+	// Blocking
+	m.HandleFunc("GET "+p+"/blocking/lists", s.authed(s.listBlocklists))
+	m.HandleFunc("POST "+p+"/blocking/lists", s.authed(s.createBlocklist))
+	m.HandleFunc("GET "+p+"/blocking/lists/{id}", s.authed(s.getBlocklist))
+	m.HandleFunc("PATCH "+p+"/blocking/lists/{id}", s.authed(s.updateBlocklist))
+	m.HandleFunc("DELETE "+p+"/blocking/lists/{id}", s.authed(s.deleteBlocklist))
+	m.HandleFunc("POST "+p+"/blocking/lists/{id}/refresh", s.authed(s.refreshBlocklist))
+	m.HandleFunc("GET "+p+"/blocking/rules", s.authed(s.listBlockRules))
+	m.HandleFunc("POST "+p+"/blocking/rules", s.authed(s.createBlockRule))
+	m.HandleFunc("DELETE "+p+"/blocking/rules", s.authed(s.deleteBlockRulesByName))
+	m.HandleFunc("PATCH "+p+"/blocking/rules/{id}", s.authed(s.updateBlockRule))
+	m.HandleFunc("DELETE "+p+"/blocking/rules/{id}", s.authed(s.deleteBlockRule))
+	m.HandleFunc("GET "+p+"/blocking/check", s.authed(s.checkBlocking))
 	m.HandleFunc("GET "+p+"/acls", s.authed(s.listACLs))
 	m.HandleFunc("POST "+p+"/acls", s.authed(s.createACL))
 	m.HandleFunc("GET "+p+"/acls/{id}", s.authed(s.getACL))