web: say what the guard actually applies

The Blocker page showed all_domains even when nothing was in force, and its
copy still called a bare '*' an invalid expansion. Hostnames now comes from
the live list (empty while blocking is off), the routed DNS zones get their
own stat, and the banners distinguish junk labels from masks no hosts file
can express — which is what the server now reports.

frontend/src/lib/types.ts

@@ -79,7 +79,12 @@ export interface RefreshResult {
 
 export interface BlockerPolicy {
   active: boolean;
+  /** Masks a hosts file cannot express: `*.x.com` (answered by the desktop app's routed DNS zone) and `*gram*` (no zone exists). */
   unexpandable?: string[];
+  /** Expansion entries that are not subdomain labels (`not a label`) — dropped. A bare `*` is kept: it means every subdomain. */
+  invalid_expansions?: string[];
+  /** The `allowed` masks, normalized — what the desktop app's resolver serves as an exception. */
+  allowed?: string[];
   reason: string;
   mode: string;
   enabled: boolean;