desktop: route wildcard zones to a local DNS stub

A hosts file cannot express a wildcard, so '*.youtube.com' was only ever the
base domain plus the guessed labels. The patterns the server now hands over
as unexpandable are answered by a stub on 127.0.0.1, and the helper owns one
systemd-resolved drop-in that points just those zones at it:

  * the stub is listening before the drop-in is written, and the drop-in is
    removed before the stub stops, so a zone's queries never land on a dead
    port;
  * stub and route live as long as the app, not the interval: between
    intervals they forward everything, instead of restarting resolved (and
    dropping its cache) on every pomodoro;
  * a crashed run leaves a world-readable drop-in the next start adopts, and
    the stub comes back before anything else;
  * masks with nothing routable after their last '*' ('*gram*') are reported
    as unenforceable, not silently dropped.

The Blocker page now reports what is really in place — the hosts region, the
routed zones, and the masks this machine cannot do — rather than the whole
expansion. 39 desktop tests, including the ordering invariants.

desktop/helper/org.kadence.helper.policy

@@ -15,8 +15,8 @@
   <vendor_url>https://github.com/</vendor_url>
 
   <action id="org.kadence.helper.manage-hosts">
-    <description>Manage the Kadence website block list</description>
-    <description xml:lang="ru">Управление списком заблокированных сайтов Kadence</description>
+    <description>Manage the Kadence website block list and its DNS routing</description>
+    <description xml:lang="ru">Управление списком заблокированных сайтов Kadence и их DNS-маршрутизацией</description>
     <message>Authentication is required to change which websites are blocked.</message>
     <message xml:lang="ru">Для изменения списка заблокированных сайтов требуется аутентификация.</message>
     <icon_name>kadence</icon_name>