Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/dashboard.js

@@ -40,6 +40,12 @@ export async function render(el) {
       h("strong", null, "The last backup failed "), time(b.last_error_at), ": " + b.last_error,
       h("div", { class: "small" }, "See 'journalctl -u jarl-backup' on the server.")));
   }
+  for (const e of st.blocklist_errors || []) {
+    parts.push(h("div", { class: "msg warn" },
+      h("strong", null, "Blocklist " + e.name + " couldn't be updated: "), e.error + ". ",
+      e.updated_at ? ["named keeps using the version from ", time(e.updated_at), ". "] : "It isn't in use yet. ",
+      "jarld tries again within the hour. ", h("a", { href: "#/blocking" }, "Blocking")));
+  }
   const tf = st.totp;
   if (tf && tf.missing && tf.missing.length) {
     parts.push(h("div", { class: "msg warn" },