Add extended forward zone type for overriding public domain records

An extended zone answers authoritatively only for the records it holds
locally; any name with nothing configured falls through to recursive
resolution instead of a synthesized NXDOMAIN, so a public domain's
records don't need to be duplicated just to override a few of them.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V8c76Xr2BycaHHu5N4buqi

web/templates/pages/zones.html

@@ -37,7 +37,7 @@
         <thead>
           <tr>
             <th>Zone</th>
-            {{if $reverse}}<th>Kind</th>{{end}}
+            <th>Kind</th>
             <th class="text-end">Records</th>
             <th class="text-end">Serial</th>
             <th class="text-end">TTL</th>
@@ -53,7 +53,7 @@
               <a href="/zones/{{.ID}}" class="fw-semibold text-decoration-none mono">{{trimDot .Name}}</a>
               {{if .Description}}<div class="small text-body-secondary">{{truncate 80 .Description}}</div>{{end}}
             </td>
-            {{if $reverse}}<td><span class="badge text-bg-light text-dark">{{.Kind.Label}}</span></td>{{end}}
+            <td><span class="badge text-bg-light text-dark">{{.Kind.Label}}</span></td>
             <td class="text-end">{{num .RecordCount}}</td>
             <td class="text-end mono small">{{.Serial}}</td>
             <td class="text-end">{{.DefaultTTL}}</td>
@@ -98,7 +98,7 @@
             "Message" "Reverse zones answer PTR lookups that turn an IP address back into a host name. Enter a subnet such as 192.168.1.0/24 and the correct in-addr.arpa zone name is worked out for you."}}
       {{else}}
         {{template "empty" dict "Icon" "bi-diagram-3" "Title" "No forward zones yet"
-            "Message" "A forward zone lets this server answer authoritatively for a domain such as internal.example.com, independently of the public DNS."}}
+            "Message" "A forward zone lets this server answer authoritatively for a domain such as internal.example.com, independently of the public DNS. An extended zone does the same but only for the records you add, forwarding everything else to the public DNS."}}
       {{end}}
       <div class="text-center pb-4">
         <a href="/zones/new?kind={{if $reverse}}reverse4{{else}}forward{{end}}" class="btn btn-primary">