Hub stage 6: blocking and cache actions on several servers

One endpoint, hub/servers/run (operate), runs a fixed set of actions on
the chosen servers in parallel with each server's admin token: add or
remove a domain in Blocked or Allowed, disable blocking for a time or
enable it, update block lists, replace the block list URLs, flush the
cache or delete a domain from it. Each server gets its own result and
the console offers Retry failed.

In "All servers", Blocking, Cache and Query Logs rows open this flow
instead of being disabled. The hub validates domains, minutes and the
server's list grammar (allow lists with !, switched-off lines with #)
and logs no URL list. Operators can now use the blocking switch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

hub/server-write.test.ts

@@ -196,13 +196,17 @@ const OPERATE = [
   ['allowed/delete', { domain: 'ok.example' }],
   ['settings/temporaryDisableBlocking', { minutes: '5' }],
   ['settings/forceUpdateBlockLists', {}],
+  // The blocking switch alone is blocking, not server settings (routes.ts `effectiveRoute`).
+  ['settings/set', { enableBlocking: 'false' }],
 ] as const
 const ADMIN = [
   ['zones/records/add', { zone: 'example.com', domain: 'www.example.com', type: 'A', ipAddress: '192.0.2.1' }],
   ['zones/delete', { zone: 'example.com' }],
   ['zones/dnssec/sign', { zone: 'example.com', algorithm: 'ECDSA' }],
   ['dhcp/scopes/enable', { name: 'Default' }],
-  ['settings/set', { enableBlocking: 'true' }],
+  ['settings/set', { dnsServerDomain: 'x.example' }],
+  // The switch plus any other field is a settings change.
+  ['settings/set', { enableBlocking: 'true', dnsServerDomain: 'x.example' }],
 ] as const
 
 describe('who may write what', () => {