desktop: route wildcard zones to a local DNS stub

A hosts file cannot express a wildcard, so '*.youtube.com' was only ever the
base domain plus the guessed labels. The patterns the server now hands over
as unexpandable are answered by a stub on 127.0.0.1, and the helper owns one
systemd-resolved drop-in that points just those zones at it:

  * the stub is listening before the drop-in is written, and the drop-in is
    removed before the stub stops, so a zone's queries never land on a dead
    port;
  * stub and route live as long as the app, not the interval: between
    intervals they forward everything, instead of restarting resolved (and
    dropping its cache) on every pomodoro;
  * a crashed run leaves a world-readable drop-in the next start adopts, and
    the stub comes back before anything else;
  * masks with nothing routable after their last '*' ('*gram*') are reported
    as unenforceable, not silently dropped.

The Blocker page now reports what is really in place — the hosts region, the
routed zones, and the masks this machine cannot do — rather than the whole
expansion. 39 desktop tests, including the ordering invariants.

desktop/helper/install.sh

@@ -36,8 +36,10 @@ if [[ $EUID -ne 0 ]]; then
 fi
 
 if [[ $UNINSTALL -eq 1 ]]; then
-  # Unblock first — leaving a block behind after uninstalling would be rude.
+  # Unblock first — leaving a block behind after uninstalling would be rude,
+  # and so would leaving the machine's DNS pointed at a stub that is gone.
   [[ -x "$HELPER_DEST" ]] && "$HELPER_DEST" clear || true
+  [[ -x "$HELPER_DEST" ]] && "$HELPER_DEST" resolved-off || true
   rm -f "$HELPER_DEST" "$POLICY_DEST" "$RULE_DEST"
   echo "Removed the helper, its polkit action and any passwordless rule."
   exit 0