Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/blocklists.go

@@ -0,0 +1,42 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+
+	"jarl/internal/model"
+)
+
+// BlocklistStatuses returns the download status of every blocklist that
+// has one.
+func (s *Store) BlocklistStatuses(ctx context.Context) (map[int64]*model.BlocklistStatus, error) {
+	rows, err := s.db.QueryContext(ctx, `SELECT id, url, etag, last_modified, checked_at, updated_at, entries, records, skipped, sha256, error FROM blocklist_status`)
+	if err != nil {
+		return nil, err
+	}
+	out := map[int64]*model.BlocklistStatus{}
+	for rows.Next() {
+		st := &model.BlocklistStatus{}
+		var checked, updated sql.NullString
+		if err := rows.Scan(&st.ID, &st.URL, &st.ETag, &st.LastModified, &checked, &updated, &st.Entries, &st.Records, &st.Skipped, &st.SHA256, &st.Error); err != nil {
+			rows.Close()
+			return nil, err
+		}
+		st.CheckedAt, st.UpdatedAt = parseTSPtr(checked), parseTSPtr(updated)
+		out[st.ID] = st
+	}
+	return out, closeRows(rows)
+}
+
+// SetBlocklistStatus stores a blocklist's download status.
+func (s *Store) SetBlocklistStatus(ctx context.Context, st *model.BlocklistStatus) error {
+	_, err := s.db.ExecContext(ctx, `INSERT OR REPLACE INTO blocklist_status (id, url, etag, last_modified, checked_at, updated_at, entries, records, skipped, sha256, error) VALUES (?,?,?,?,?,?,?,?,?,?,?)`,
+		st.ID, st.URL, st.ETag, st.LastModified, tsPtr(st.CheckedAt), tsPtr(st.UpdatedAt), st.Entries, st.Records, st.Skipped, st.SHA256, st.Error)
+	return err
+}
+
+// DeleteBlocklistStatus forgets a deleted blocklist's status.
+func (s *Store) DeleteBlocklistStatus(ctx context.Context, id int64) error {
+	_, err := s.db.ExecContext(ctx, `DELETE FROM blocklist_status WHERE id = ?`, id)
+	return err
+}