Label DNS policy redirects accurately

The query log classified every non-drop blocklist match as a block, even when an RPZ A or CNAME rule returned a successful redirect. Record redirect results with their own action so NOERROR address overrides are not presented or counted as blocked. Expose the new action in the Logs filter.

internal/engine/engine.go

@@ -368,6 +368,13 @@ func (e *Engine) Handle(ctx context.Context, req Request) Response {
 			res.Duration = time.Since(start)
 			e.finish(req, res, start, decision)
 			return res
+		case blocklist.ActionRedirect, blocklist.ActionCNAME:
+			res.Msg = e.finalize(e.blockedMsg(q, blocked), q, req)
+			res.Action = qlog.ActionRedirect
+			res.BlockSource = blocked.Source
+			res.CacheHit = false
+			e.finish(req, res, start, decision)
+			return res
 		default:
 			res.Msg = e.finalize(e.blockedMsg(q, blocked), q, req)
 			res.Action = qlog.ActionBlock
@@ -502,6 +509,8 @@ func outcomeFor(res Response) string {
 		return metrics.OutcomeCache
 	case qlog.ActionBlock:
 		return metrics.OutcomeBlocked
+	case qlog.ActionRedirect:
+		return metrics.OutcomeLocal
 	case qlog.ActionError, qlog.ActionDrop:
 		return metrics.OutcomeError
 	case qlog.ActionRefused: