Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/state.go

@@ -149,6 +149,44 @@ func loadState(ctx context.Context, e execer) (*model.State, error) {
 	if err := closeRows(rows); err != nil {
 		return nil, err
 	}
+
+	rows, err = e.QueryContext(ctx, `SELECT id, name, url, view_ids, disabled, comment, version, created_at, updated_at, created_by, updated_by FROM blocklists`)
+	if err != nil {
+		return nil, err
+	}
+	for rows.Next() {
+		b := &model.Blocklist{}
+		var views, ca, ua string
+		if err := rows.Scan(&b.ID, &b.Name, &b.URL, &views, &b.Disabled, &b.Comment, &b.Version, &ca, &ua, &b.CreatedBy, &b.UpdatedBy); err != nil {
+			rows.Close()
+			return nil, err
+		}
+		json.Unmarshal([]byte(views), &b.ViewIDs)
+		b.CreatedAt, b.UpdatedAt = parseTS(ca), parseTS(ua)
+		st.Blocklists[b.ID] = b
+	}
+	if err := closeRows(rows); err != nil {
+		return nil, err
+	}
+
+	rows, err = e.QueryContext(ctx, `SELECT id, name, action, exact, view_ids, comment, version, created_at, updated_at, created_by, updated_by FROM block_rules`)
+	if err != nil {
+		return nil, err
+	}
+	for rows.Next() {
+		r := &model.BlockRule{}
+		var views, ca, ua string
+		if err := rows.Scan(&r.ID, &r.Name, &r.Action, &r.Exact, &views, &r.Comment, &r.Version, &ca, &ua, &r.CreatedBy, &r.UpdatedBy); err != nil {
+			rows.Close()
+			return nil, err
+		}
+		json.Unmarshal([]byte(views), &r.ViewIDs)
+		r.CreatedAt, r.UpdatedAt = parseTS(ca), parseTS(ua)
+		st.BlockRules[r.ID] = r
+	}
+	if err := closeRows(rows); err != nil {
+		return nil, err
+	}
 	return st, nil
 }
 
@@ -166,7 +204,7 @@ func (t *Tx) SaveState(old, new *model.State) error {
 // ReplaceState replaces the stored configuration with st (used by import
 // and tests).
 func (t *Tx) ReplaceState(st *model.State) error {
-	for _, tbl := range []string{"views", "acls", "tsig_keys", "zones", "records", "options"} {
+	for _, tbl := range []string{"views", "acls", "tsig_keys", "zones", "records", "options", "blocklists", "block_rules"} {
 		if _, err := t.tx.ExecContext(t.ctx, "DELETE FROM "+tbl); err != nil {
 			return err
 		}
@@ -226,11 +264,32 @@ func saveState(ctx context.Context, e execer, old, new *model.State) error {
 	}, func(id int64) error { return del(ctx, e, "records", id) }); err != nil {
 		return err
 	}
-	return diffMap(old.Options, new.Options, func(o *model.Option) error {
+	if err := diffMap(old.Options, new.Options, func(o *model.Option) error {
 		_, err := e.ExecContext(ctx, `INSERT OR REPLACE INTO options (id, scope, scope_id, name, value, position, comment, version, created_at, updated_at, created_by, updated_by) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)`,
 			o.ID, o.Scope, o.ScopeID, o.Name, o.Value, o.Position, o.Comment, o.Version, ts(o.CreatedAt), ts(o.UpdatedAt), o.CreatedBy, o.UpdatedBy)
 		return err
-	}, func(id int64) error { return del(ctx, e, "options", id) })
+	}, func(id int64) error { return del(ctx, e, "options", id) }); err != nil {
+		return err
+	}
+	if err := diffMap(old.Blocklists, new.Blocklists, func(b *model.Blocklist) error {
+		_, err := e.ExecContext(ctx, `INSERT OR REPLACE INTO blocklists (id, name, url, view_ids, disabled, comment, version, created_at, updated_at, created_by, updated_by) VALUES (?,?,?,?,?,?,?,?,?,?,?)`,
+			b.ID, b.Name, b.URL, jsonText(nonNilIDs(b.ViewIDs)), b.Disabled, b.Comment, b.Version, ts(b.CreatedAt), ts(b.UpdatedAt), b.CreatedBy, b.UpdatedBy)
+		return err
+	}, func(id int64) error { return del(ctx, e, "blocklists", id) }); err != nil {
+		return err
+	}
+	return diffMap(old.BlockRules, new.BlockRules, func(r *model.BlockRule) error {
+		_, err := e.ExecContext(ctx, `INSERT OR REPLACE INTO block_rules (id, name, action, exact, view_ids, comment, version, created_at, updated_at, created_by, updated_by) VALUES (?,?,?,?,?,?,?,?,?,?,?)`,
+			r.ID, r.Name, r.Action, r.Exact, jsonText(nonNilIDs(r.ViewIDs)), r.Comment, r.Version, ts(r.CreatedAt), ts(r.UpdatedAt), r.CreatedBy, r.UpdatedBy)
+		return err
+	}, func(id int64) error { return del(ctx, e, "block_rules", id) })
+}
+
+func nonNilIDs(ids []int64) []int64 {
+	if ids == nil {
+		return []int64{}
+	}
+	return ids
 }
 
 func nonNil(s []string) []string {