blocker: an exception reads like a block, so make it behave like one

`youtube.com` on the block list catches `music.youtube.com` — a plain entry
covers its subtree. `youtube.com` on the *allow* list caught only itself,
because exceptions were glob-matched whatever they looked like and a plain name
has no metacharacters. The same text in two boxes of the same form meant a
subtree in one and a single hostname in the other, with nothing in the UI
saying so.

A plain exception now covers its subdomains; a masked one is glob-matched
exactly as before, which is still how you spare something narrower than a whole
subtree (`docs.*`, `*.docs.google.com`).

Three enforcers decide this and all three had to move together, or an exception
would work in the browser and not at the resolver: `blocker_service.is_allowed`,
`:core`'s `isAllowed`, and the desktop DNS stub's own allow check, which was
reusing the generic glob matcher. Parity tests on both sides, plus the two
sentences in the web UI and the README that promised the old behaviour.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -67,8 +67,11 @@ native desktop app enforces them on your machine:
   `*` to that list and "every" means every, answered by the DNS stub rather than by
   guessed hostnames. A hosts file has no wildcards at all, so `*gram*` is reported
   honestly as unenforceable on the machine rather than silently ignored.
-  Exceptions take masks too, so `*.google.com` blocked plus `*.docs.google.com`
-  allowed does what you would expect.
+  Exceptions read exactly like blocks: a plain one covers its subdomains
+  (`youtube.com` allowed spares `music.youtube.com`, the same way blocking it
+  catches them), and a masked one is a mask — so `*.google.com` blocked plus
+  `*.docs.google.com` allowed does what you would expect, and `docs.*` allowed
+  is how you spare something narrower than a whole subtree.
 * **Applications** — `/proc` is watched and blocked apps are closed (or just
   reported, if you prefer a warning). Entries here are globs as well: `steam*`,
   `*discord*`, matched against the process name and its command line.