DNSSEC: say where the DS record really goes

The DNSSEC tab said "give this to your registrar" for every zone whose
parent wasn't in Jarl in the same view. The DNSSEC response now has
ds_at/ds_place/ds_note: the parent zone in Jarl (any view, its own
first, then a public one), the registrar for a registered domain, the
parent zone wherever it is hosted for a subdomain, the ISP or RIR for a
reverse zone, and nowhere for a private name. The page and the CLI use
them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/api.md

@@ -294,11 +294,20 @@ view ([dnssec.md](dnssec.md#what-jarl-refuses-and-why)).
   },
   "named": {"secure": true, "inline_signing": true, "serial": 2026100802, "signed_serial": 2026100804, "next_key_event": "..."},
   "policies": ["default"],
-  "parent_zone": "",          // set when the parent zone is a primary zone in Jarl
+  "ds_at": "registrar",       // parent_zone, registrar, parent, reverse or none
+  "ds_place": "at your registrar", // completes "add the DS record ..."
+  "ds_note": "",              // for ds_at none: why it can't have one
+  "parent_zone": "",          // set when the parent zone is a primary zone in Jarl (any view, its own first)
   "registrar": "porkbun"      // when the DS can be published through Jarl
 }
 ```
 
+`ds_at` says where the DS record goes ([dnssec.md](dnssec.md#should-you-sign)):
+`parent_zone` (a zone in Jarl: `parent_zone`, `parent_zone_id`,
+`parent_view`), `registrar` (the zone is a registered domain), `parent` (a
+subdomain whose parent zone is hosted elsewhere), `reverse` (whoever
+delegates the addresses) or `none` (nothing on the internet delegates it).
+
 `phase.code` is one of `off`, `leftover_keys`, `starting`, `signing`,
 `ready`, `ds_pending`, `secure`, `removing_ds`, `ds_expiring`,
 `removing_keys`, `unsigned` ([dnssec.md](dnssec.md#phases)).