desktop: route wildcard zones to a local DNS stub

A hosts file cannot express a wildcard, so '*.youtube.com' was only ever the
base domain plus the guessed labels. The patterns the server now hands over
as unexpandable are answered by a stub on 127.0.0.1, and the helper owns one
systemd-resolved drop-in that points just those zones at it:

  * the stub is listening before the drop-in is written, and the drop-in is
    removed before the stub stops, so a zone's queries never land on a dead
    port;
  * stub and route live as long as the app, not the interval: between
    intervals they forward everything, instead of restarting resolved (and
    dropping its cache) on every pomodoro;
  * a crashed run leaves a world-readable drop-in the next start adopts, and
    the stub comes back before anything else;
  * masks with nothing routable after their last '*' ('*gram*') are reported
    as unenforceable, not silently dropped.

The Blocker page now reports what is really in place — the hosts region, the
routed zones, and the masks this machine cannot do — rather than the whole
expansion. 39 desktop tests, including the ordering invariants.

desktop/kadence_desktop/blocking/hosts.py

@@ -97,6 +97,19 @@ class HostsBlocker:
     def apply(self, domains: list[str], redirect_ip: str = "127.0.0.1") -> bool:
         """Make the managed region exactly `domains`. True when it already was."""
         wanted = sorted({d.strip().lower() for d in domains if valid_hostname(d)})
+
+        # Never drop a hostname without saying so. The server expands masks for us,
+        # and a bad `subdomain_expansions` entry (`*` is the one people try) used to
+        # arrive here as a non-hostname and vanish into this filter — the mask looked
+        # applied and blocked nothing. The server refuses those labels now; this is
+        # the backstop, and it is loud.
+        refused = sorted({d.strip().lower() for d in domains if d.strip() and not valid_hostname(d)})
+        if refused:
+            log.warning(
+                "not a hostname, so not blocked: %s — check subdomain_expansions",
+                ", ".join(refused[:10]),
+            )
+
         if sorted(set(current_block())) == wanted:
             return True
         if not wanted: