Add extended forward zone type for overriding public domain records

An extended zone answers authoritatively only for the records it holds
locally; any name with nothing configured falls through to recursive
resolution instead of a synthesized NXDOMAIN, so a public domain's
records don't need to be duplicated just to override a few of them.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V8c76Xr2BycaHHu5N4buqi

web/templates/pages/zone_form.html

@@ -31,6 +31,7 @@
             <label class="form-label" for="kindSelect">Zone type</label>
             <select class="form-select" id="kindSelect" name="kind">
               <option value="forward" {{if eq $kind "forward"}}selected{{end}}>Forward — resolve names to addresses</option>
+              <option value="extended" {{if eq $kind "extended"}}selected{{end}}>Extended — override records for a domain otherwise resolved on the public DNS</option>
               <option value="reverse4" {{if eq $kind "reverse4"}}selected{{end}}>Reverse IPv4 — resolve addresses back to names</option>
               <option value="reverse6" {{if eq $kind "reverse6"}}selected{{end}}>Reverse IPv6 — resolve addresses back to names</option>
             </select>
@@ -52,6 +53,14 @@
           <input type="hidden" name="kind" value="{{$kind}}">
           {{end}}
 
+          {{if eq $kind "extended"}}
+          <div class="alert alert-info small mb-3">
+            An extended zone answers locally only for the records you add below. Any other
+            name or record type under this zone is forwarded to the public DNS, and only
+            fails if the internet lookup also fails.
+          </div>
+          {{end}}
+
           <div class="mb-3">
             <label class="form-label" for="zoneName">
               Zone name {{if and $new $isReverse}}<span class="text-body-secondary fw-normal">(optional if a subnet is given)</span>{{end}}