Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/store.go

@@ -263,6 +263,43 @@ CREATE TABLE recovery_codes (
 	// 5: disabled records, kept but left out of the zone.
 	`
 ALTER TABLE records ADD COLUMN disabled INTEGER NOT NULL DEFAULT 0;
+`,
+	// 6: blocking (docs/blocking.md). blocklist_status holds what jarld
+	// learns downloading lists; it is not configuration.
+	`
+CREATE TABLE blocklists (
+	id INTEGER PRIMARY KEY,
+	name TEXT NOT NULL,
+	url TEXT NOT NULL,
+	view_ids TEXT NOT NULL DEFAULT '[]',
+	disabled INTEGER NOT NULL DEFAULT 0,
+	comment TEXT NOT NULL DEFAULT '',
+	version INTEGER NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+	created_by TEXT NOT NULL DEFAULT '', updated_by TEXT NOT NULL DEFAULT ''
+);
+CREATE TABLE block_rules (
+	id INTEGER PRIMARY KEY,
+	name TEXT NOT NULL,
+	action TEXT NOT NULL,
+	exact INTEGER NOT NULL DEFAULT 0,
+	view_ids TEXT NOT NULL DEFAULT '[]',
+	comment TEXT NOT NULL DEFAULT '',
+	version INTEGER NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+	created_by TEXT NOT NULL DEFAULT '', updated_by TEXT NOT NULL DEFAULT ''
+);
+CREATE TABLE blocklist_status (
+	id INTEGER PRIMARY KEY,
+	url TEXT NOT NULL DEFAULT '',
+	etag TEXT NOT NULL DEFAULT '',
+	last_modified TEXT NOT NULL DEFAULT '',
+	checked_at TEXT,
+	updated_at TEXT,
+	entries INTEGER NOT NULL DEFAULT 0,
+	records INTEGER NOT NULL DEFAULT 0,
+	skipped INTEGER NOT NULL DEFAULT 0,
+	sha256 TEXT NOT NULL DEFAULT '',
+	error TEXT NOT NULL DEFAULT ''
+);
 `,
 }