option set: statements with a name replace only that one; forwarding over TLS documented

jarl option set tls NAME (and key, remote-servers, primaries, http, dnssec-policy, key-store, server, acl, view, zone, parental-agents) matches the name after the keyword too: setting tls cloudflare no longer replaces tls quad9. jarl option unset tls NAME removes one by its name. docs/encrypted-dns.md has forwarding to Quad9 or Cloudflare over TLS: one changeset, the options explained, several providers, checking it works, and why not over HTTPS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -57,6 +57,8 @@ All notable changes to Jarl are documented here. The format follows
   starts from where the records are now. The Certificates page and `jarl
   cert show` say what named uses a certificate for (DNS over TLS or HTTPS,
   on which addresses and ports).
+- docs/encrypted-dns.md: forwarding to Quad9 or Cloudflare over TLS, how to
+  check it works, and why not over HTTPS.
 - Comparing one name across views: `jarl zone diff adbraun.lol nas [A]`,
   and a **Compare** button on each record.
 
@@ -74,6 +76,10 @@ All notable changes to Jarl are documented here. The format follows
 
 ### Changed
 
+- `jarl option set tls NAME …` (and `key`, `remote-servers`, `http`,
+  `dnssec-policy`, `server` …) replaces only the statement with that name:
+  setting `tls cloudflare` used to replace `tls quad9`. `jarl option unset
+  tls cloudflare` removes one by its name.
 - **Compare views** and `jarl zone diff` are rebuilt around the view
   you're on (docs/views.md#comparing-views): a summary per view, then
   what is answered differently (a view's own records in linked zones,