milestone 28: query provenance — every logged query is exactly explainable

query rows gain qclass, rcode, group, policy action and reason, the
matched rule or list entry with its source, cname and safe-search
targets, route kind, forward zone, and the resolver that actually
answered — the pool and local markers die. servfails are logged and
name the resolver that lost; post-parse protocol refusals become rows.
a detail page at /queries/:id renders the ordered explanation, and
coverage watermarks distinguish an empty history from a missing one.

the schema fingerprint changes: existing query history is recreated
with the old file kept aside and the reset filed as a resolved
diagnostic. fixes an oversized udp reply being rebuilt as noerror,
which handed clients a truncated nxdomain as success.

src/web/sse.zig

@@ -25,6 +25,14 @@ pub const max_subscribers = 32;
 
 /// Entries one subscriber may fall behind by. At household query rates this is
 /// several seconds of slack on a stalled TCP connection.
+///
+/// The ring is embedded in the slot, so this multiplies `@sizeOf(logger.Entry)`
+/// — about 1.8 KiB once milestone 28 widened it for provenance. One subscriber
+/// therefore costs roughly 115 KiB of ring and the whole hub roughly 3.6 MiB,
+/// allocated once for the life of the process. That is the reason to keep both
+/// this and `max_subscribers` small: they are paid whether or not anyone is
+/// watching. `logger.query_log_buffer_max` bounds the other consumer of the
+/// same width, the writer queue.
 pub const ring_capacity = 64;
 
 pub const SubscriberId = enum(u8) { _ };