milestone 28: query provenance — every logged query is exactly explainable

query rows gain qclass, rcode, group, policy action and reason, the
matched rule or list entry with its source, cname and safe-search
targets, route kind, forward zone, and the resolver that actually
answered — the pool and local markers die. servfails are logged and
name the resolver that lost; post-parse protocol refusals become rows.
a detail page at /queries/:id renders the ordered explanation, and
coverage watermarks distinguish an empty history from a missing one.

the schema fingerprint changes: existing query history is recreated
with the old file kept aside and the reset filed as a resolved
diagnostic. fixes an oversized udp reply being rebuilt as noerror,
which handed clients a truncated nxdomain as success.

admin/src/features/dashboard/DashboardPage.test.tsx

@@ -18,6 +18,7 @@ const RESPONSES: Record<string, unknown> = {
 		cached: 100,
 		clients: 7,
 		avg_response_time_us: 2345,
+		coverage: { complete: true, available_since: 0 },
 	},
 	"/api/stats/timeseries?period=24h": {
 		period: "24h",
@@ -29,6 +30,7 @@ const RESPONSES: Record<string, unknown> = {
 			{ ts: 1800, queries: 40, blocked: 0, cached: 0 },
 			{ ts: 3600, queries: 0, blocked: 0, cached: 0 },
 		],
+		coverage: { complete: true, available_since: 0 },
 	},
 	"/api/stats?period=1h": {
 		period: "1h",
@@ -39,6 +41,7 @@ const RESPONSES: Record<string, unknown> = {
 		cached: 0,
 		clients: 2,
 		avg_response_time_us: null,
+		coverage: { complete: true, available_since: 0 },
 	},
 	"/api/stats/timeseries?period=1h": {
 		period: "1h",
@@ -46,6 +49,7 @@ const RESPONSES: Record<string, unknown> = {
 		until: 3600,
 		bucket_seconds: 60,
 		buckets: [],
+		coverage: { complete: true, available_since: 0 },
 	},
 	"/api/health": {
 		status: "degraded",