Hub stage 7: compare and align zones, settings and blocking

Zones gets "All servers" in hub mode: one table of every zone on every
server with its type and serial, marking zones that are on one server
only or whose serials or types differ. A zone can be copied to another
server (export, create, import; Overwrite must be ticked for a zone
that is already there) or made a Secondary there (the source's zone
transfer and notify lists gain the target, then the target zone is
created).

Settings and Blocking can be compared across servers against a baseline
kept in the hub. Host fields stay local, secrets are compared inside
the hub only and never shown or logged, and an apply sends only the
changed shared fields after saving each server's settings to history.
Blocked and Allowed lists are compared as sets; extras are removed only
when asked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

hub/drift.ts

@@ -16,6 +16,12 @@ import { readConfigText } from './apps-config.ts'
 import { listBaselineApps, readBaseline, readOverrides, writeAtomic } from './store.ts'
 import type { Upstream } from './upstream.ts'
 
+/*
+Not yet (stage 7): settings are not part of this check yet. A `settings` kind would need `DriftEntry.app`
+(and `count()`, which feeds the header badge) to stand for something other than an app. For now the
+Settings and Blocking compare views (settings-config.ts) are the way to see a server that moved away
+from the settings baseline.
+*/
 export type DriftKind = 'differs' | 'unreadable' | 'not-installed'
 
 export interface DriftEntry {