Hub stage 7: compare and align zones, settings and blocking

Zones gets "All servers" in hub mode: one table of every zone on every
server with its type and serial, marking zones that are on one server
only or whose serials or types differ. A zone can be copied to another
server (export, create, import; Overwrite must be ticked for a zone
that is already there) or made a Secondary there (the source's zone
transfer and notify lists gain the target, then the target zone is
created).

Settings and Blocking can be compared across servers against a baseline
kept in the hub. Host fields stay local, secrets are compared inside
the hub only and never shown or logged, and an apply sends only the
changed shared fields after saving each server's settings to history.
Blocked and Allowed lists are compared as sets; extras are removed only
when asked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

hub/routes.ts

@@ -159,6 +159,25 @@ export const ROUTES: Record<string, Route> = {
   'hub/apps/upload': writeAll('apps.write'),
   // The same change on several servers, outside Apps (servers-run.ts). One endpoint with a fixed list of actions.
   'hub/servers/run': writeAll('operate'),
+  // Zones across the servers (zones-sync.ts). The merged list is zone names and serials only.
+  'hub/zones/matrix': read(),
+  'hub/zones/copy/preview': read('admin'),
+  'hub/zones/copy': writeAll('admin'),
+  'hub/zones/secondary/preview': read('admin'),
+  'hub/zones/secondary': writeAll('admin'),
+  // Settings and blocking lists across the servers (settings-config.ts). Settings carry secrets, so even reads need admin.
+  'hub/settings/compare': read('admin'),
+  'hub/settings/preview': read('admin'),
+  'hub/settings/history/list': read('admin'),
+  'hub/settings/history/get': read('admin'),
+  'hub/settings/baseline/import': writeAll('admin'),
+  'hub/settings/baseline/save': writeAll('admin'),
+  'hub/settings/overrides/save': writeAll('admin'),
+  'hub/settings/apply': writeAll('admin'),
+  'hub/blocking/lists/compare': read('admin'),
+  'hub/blocking/lists/preview': read('admin'),
+  'hub/blocking/lists/baseline/import': writeAll('admin'),
+  'hub/blocking/lists/apply': writeAll('admin'),
 }
 
 export function routeFor(apiPath: string): Route | undefined {
@@ -199,6 +218,8 @@ const LARGE_BODIES: Record<string, number> = {
   'zones/records/update': 2 * MB,
   'zones/options/set': 2 * MB,
   'dhcp/scopes/set': 2 * MB,
+  'hub/settings/baseline/save': 2 * MB,
+  'hub/settings/overrides/save': 2 * MB,
   'allowed/import': 5 * MB,
   'blocked/import': 5 * MB,
 }