Add extended forward zone type for overriding public domain records

An extended zone answers authoritatively only for the records it holds
locally; any name with nothing configured falls through to recursive
resolution instead of a synthesized NXDOMAIN, so a public domain's
records don't need to be duplicated just to override a few of them.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V8c76Xr2BycaHHu5N4buqi

README.md

@@ -229,6 +229,30 @@ A typical internal zone:
 Names are relative to the zone apex; `@` is the apex itself and `*` is a
 wildcard. Quoting and 255-character chunking for TXT records is handled for you.
 
+### An extended zone
+
+```bash
+# UI: Zones → Forward Zones → Add Zone → Zone type: Extended
+```
+
+Use this when you want to override a handful of records for a domain that is
+otherwise a real public domain, without copying every one of its public
+records into vibeDNS. Only the names you add records for are answered
+locally; every other name (and every other record type at names you did add)
+is forwarded to the upstream resolver, exactly like a query for a domain with
+no local zone at all. If the local lookup finds nothing, the query goes to
+the internet; if that also fails, the client gets an error, not a false
+NXDOMAIN.
+
+| Name | Type | Value | TTL |
+|---|---|---|---|
+| `vpn` | A | `192.168.1.10` | 3600 |
+
+With a zone like `example.com` set to Extended and only `vpn.example.com`
+configured, `vpn.example.com` resolves locally while `www.example.com`,
+`example.com` itself, and everything else under the domain still resolve
+against the public DNS.
+
 ### Reverse DNS
 
 The point of the reverse zone form is that you never calculate a zone name.