DNSSEC: say where the DS record really goes

The DNSSEC tab said "give this to your registrar" for every zone whose
parent wasn't in Jarl in the same view. The DNSSEC response now has
ds_at/ds_place/ds_note: the parent zone in Jarl (any view, its own
first, then a public one), the registrar for a registered domain, the
parent zone wherever it is hosted for a subdomain, the ISP or RIR for a
reverse zone, and nowhere for a private name. The page and the CLI use
them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/types.go

@@ -465,8 +465,20 @@ type DNSSECResponse struct {
 	View string `json:"view,omitempty"`
 	Type string `json:"type"`
 	*dnssec.Status
+	// DSAt says where the zone's DS record goes: "parent_zone" (a primary
+	// zone in Jarl, below), "registrar" (the zone is a registered domain),
+	// "parent" (a subdomain whose parent zone is hosted elsewhere),
+	// "reverse" (whoever delegates the addresses) or "none" (nothing on
+	// the internet delegates the zone, so it can't have one).
+	DSAt string `json:"ds_at"`
+	// DSPlace completes "add the DS record …" ("at your registrar"); ""
+	// for "none".
+	DSPlace string `json:"ds_place,omitempty"`
+	// DSNote explains DSAt "none".
+	DSNote string `json:"ds_note,omitempty"`
 	// ParentZone is set when the parent zone is a primary zone in Jarl
-	// (in the same view): the DS record then goes there, as a record.
+	// (in the zone's own view, else preferably a public one): the DS
+	// record then goes there, as a record.
 	ParentZone   string `json:"parent_zone,omitempty"`
 	ParentZoneID int64  `json:"parent_zone_id,omitempty"`
 	ParentView   string `json:"parent_view,omitempty"`