Encrypted DNS health, comparing a zone's views, --local everywhere

jarld checks the DoT and DoH listeners every 10 minutes as a client would (page, dashboard, jarl encrypted-dns health, jarl_encrypted_dns_up). The Compare views tab and jarl zone diff show what differs between a zone's views, with Use this version. --local works on unlinked zones. A changed certificates.dir is followed by encrypted DNS's tls statements. Sharing an already shared version replaces other views' overrides.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -221,6 +221,7 @@ jarl zone unlink adbraun.lol --view vps
 jarl record add adbraun.lol nas A 10.0.10.20 --view internal --local   # this view only
 jarl record set adbraun.lol www A 10.0.10.5 --view internal --local    # override the shared www A here
 jarl record update 1234 --local | --shared
+jarl zone diff adbraun.lol [--view V --view W] [--all]                 # what differs between the views
 ```
 
 When a zone exists in several views, add `--view NAME` to commands that
@@ -417,6 +418,7 @@ See [exposure.md](exposure.md).
 jarl encrypted-dns                                   # what is set up, what to give clients
 jarl encrypted-dns setup --hostname dns.adbraun.lol --address 10.0.10.5 [--address IPv6] [--doh-port 8443] [--no-doh]
 jarl encrypted-dns check --address 10.0.10.5 --doh-port 443
+jarl encrypted-dns health                            # check the listeners now, as a client would
 jarl encrypted-dns disable
 ```