DNSSEC: say where the DS record really goes

The DNSSEC tab said "give this to your registrar" for every zone whose
parent wasn't in Jarl in the same view. The DNSSEC response now has
ds_at/ds_place/ds_note: the parent zone in Jarl (any view, its own
first, then a public one), the registrar for a registered domain, the
parent zone wherever it is hosted for a subdomain, the ISP or RIR for a
reverse zone, and nowhere for a private name. The page and the CLI use
them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/dsat_test.go

@@ -0,0 +1,37 @@
+package server
+
+import (
+	"strings"
+	"testing"
+)
+
+// The DNSSEC page says where each zone's DS record goes.
+func TestDNSSECWhereDSGoes(t *testing.T) {
+	e := newAPIEnv(t)
+	e.do("POST", "/views", e.token, map[string]any{"name": "internal", "match_clients": []string{"10.0.0.0/8"}}, 201)
+	e.do("POST", "/views", e.token, map[string]any{"name": "external"}, 201)
+	zone := func(name, view string) {
+		e.do("POST", "/zones", e.token, map[string]any{"name": name, "view": view, "nameservers": []string{"ns1.example.net."}}, 201)
+	}
+	zone("adbraun.lol", "external")
+	zone("lab.adbraun.lol", "external")
+	zone("dev.adbraun.lol", "internal") // its parent only in external
+	zone("sub.example.com", "external")
+	zone("10.0.10.0/24", "internal")
+	zone("home.lan", "internal")
+	for _, c := range []struct{ zone, at, place, parent string }{
+		{"adbraun.lol?view=external", "registrar", "at your registrar", ""},
+		{"lab.adbraun.lol?view=external", "parent_zone", "in the parent zone adbraun.lol", "adbraun.lol."},
+		{"dev.adbraun.lol?view=internal", "parent_zone", "in the parent zone adbraun.lol (view external)", "adbraun.lol."},
+		{"sub.example.com?view=external", "parent", "in its parent zone (most likely example.com)", ""},
+		{"10.0.10.in-addr.arpa?view=internal", "reverse", "your ISP", ""},
+		{"home.lan?view=internal", "none", "", ""},
+	} {
+		r := e.do("GET", "/zones/"+strings.Replace(c.zone, "?", "/dnssec?", 1), e.token, nil, 200)
+		place, _ := r["ds_place"].(string)
+		parent, _ := r["parent_zone"].(string)
+		if r["ds_at"] != c.at || !strings.Contains(place, c.place) || (c.place == "" && place != "") || parent != c.parent {
+			t.Errorf("%s: ds_at %v, ds_place %q, parent_zone %q", c.zone, r["ds_at"], place, parent)
+		}
+	}
+}