Internet exposure checks and response rate limiting

Jarl works out which views are reachable from the internet (match-clients
ending in a catch-all, not private-looking addresses: an internal view of a
global IPv6 prefix is still yours; a server without views: open allow-query
and a non-private listen address), with a per-view override (schema 9), and
checks public ones: rate limiting, open resolver, minimal-any, cache
snooping, open NOTIFY and transfers, version and host name, management
interfaces. Fixes are staged like any change, including rate limiting from
ISC's example in log-only mode with the secondaries exempt, then enforcing.
named logs what rate limiting limits (or would, in log-only mode, where its
counters don't move) as query-errors; Jarl routes those lines to its log
and counts them (rrl breakdown, ratelimited top lists, Prometheus
jarl_ratelimit_logged_total), shown on the new Exposure page.

A change that newly opens a public view up must be confirmed (accept_risk,
--accept-risk, a checkbox on the Changes page; 409 confirm_risk
otherwise). Findings can be acknowledged with a reason and stay visible as
info. GET /exposure, POST /exposure/fix|ack|unack, jarl exposure,
docs/exposure.md.

Also fixes query statistics skipping TSIG-signed queries ("IP#port/key
NAME" in named's log).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -143,6 +143,7 @@ to stderr with `-o json` or `-o yaml`, so stdout holds just the documents.
 | `-n, --dry-run` | Validate and show the diff without changing anything. |
 | `-C, --changeset ID` | Stage the change into an open changeset instead of applying it. |
 | `--force` | Overwrite BIND files that were changed outside Jarl (drift). |
+| `--accept-risk` | Confirm a change that opens a public view up, such as an open resolver ([exposure.md](exposure.md)). Without it such a change stops with exit 5. |
 | `-q, --quiet` | Print only errors, or just the IDs: of what a command creates, or what `show` and `list` find (like `-o id`). |
 
 ## Exit codes
@@ -382,6 +383,20 @@ an administrator).
 
 Changesets staged in the web UI show up here too, and the other way round.
 
+## Internet exposure
+
+```sh
+jarl exposure                                         # public views, findings, fixes, rate limiting
+jarl exposure fix external exposure_rate_limit        # rate limiting, log-only first
+jarl exposure fix external exposure_rate_limit_log_only   # then start enforcing
+jarl exposure fix server exposure_version
+jarl exposure ack external security_open_resolver --reason "public resolver, monitored"
+jarl exposure unack external security_open_resolver
+jarl view update external --exposure public|private|auto
+```
+
+See [exposure.md](exposure.md).
+
 ## Views, ACLs, TSIG keys, options, settings
 
 ```sh