Label DNS policy redirects accurately

The query log classified every non-drop blocklist match as a block, even when an RPZ A or CNAME rule returned a successful redirect. Record redirect results with their own action so NOERROR address overrides are not presented or counted as blocked. Expose the new action in the Logs filter.

web/src/lib/types.ts

@@ -22,7 +22,7 @@ export type Health = 'ok' | 'degraded' | 'down'
 /** One upstream server's circuit-breaker view. */
 export type UpstreamHealth = 'up' | 'down' | 'degraded'
 /** The decision the pipeline reached for a query (qlog.Action). */
-export type LogAction = 'allow' | 'block' | 'cached' | 'error' | 'drop' | 'refused'
+export type LogAction = 'allow' | 'block' | 'redirect' | 'cached' | 'error' | 'drop' | 'refused'
 /** What a rule does to the name it matches (blocklist.ParseAction). */
 export type DomainAction =
   | 'allow'

web/src/pages/Logs.tsx

@@ -54,6 +54,7 @@ const ACTION_OPTIONS = [
   { value: '', label: 'All actions' },
   { value: 'allow', label: 'Allow' },
   { value: 'cached', label: 'Cached' },
+  { value: 'redirect', label: 'Redirect' },
   { value: 'block', label: 'Block' },
   { value: 'error', label: 'Error' },
   { value: 'drop', label: 'Drop' },
@@ -73,6 +74,8 @@ function actionTone(action: string): 'default' | 'ok' | 'warn' | 'danger' | 'inf
       return 'default'
     case 'cached':
       return 'info'
+    case 'redirect':
+      return 'info'
     case 'block':
       return 'warn'
     case 'error':