Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/style.css

@@ -168,7 +168,7 @@ textarea { width: 100%; min-height: 80px; resize: vertical; }
 .form-grid input, .form-grid select { width: 100%; max-width: 560px; }
 .inline-form { display: flex; gap: 6px; flex-wrap: wrap; align-items: flex-end; }
 .inline-form .f { display: flex; flex-direction: column; gap: 2px; }
-.inline-form .f label { font-size: 11px; color: var(--muted); text-transform: uppercase; letter-spacing: 0.3px; }
+.inline-form .f label:not(.check) { font-size: 11px; color: var(--muted); text-transform: uppercase; letter-spacing: 0.3px; }
 .inline-form .grow { flex: 1; min-width: 220px; }
 .inline-form .grow input { width: 100%; }
 .hint { color: var(--muted); font-size: 12px; margin-top: 4px; }
@@ -442,4 +442,6 @@ footer.site a:hover { color: var(--accent); text-decoration-color: currentColor;
 .query-log code { background: var(--code-bg); padding: 1px 6px; border-radius: 4px; overflow-wrap: anywhere; }
 .query-log li.pending code { opacity: 0.85; }
 .err-text { color: var(--err); }
+ul.plain { list-style: none; margin: 8px 0; padding: 0; }
+ul.plain li { padding: 3px 0; }
 .query-details { margin: 8px 0; }