Encrypted DNS health, comparing a zone's views, --local everywhere

jarld checks the DoT and DoH listeners every 10 minutes as a client would (page, dashboard, jarl encrypted-dns health, jarl_encrypted_dns_up). The Compare views tab and jarl zone diff show what differs between a zone's views, with Use this version. --local works on unlinked zones. A changed certificates.dir is followed by encrypted DNS's tls statements. Sharing an already shared version replaces other views' overrides.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/views.md

@@ -209,6 +209,23 @@ each view (Jarl lists them). Share the right version afterwards. Unlinking
 keeps every record, all local; a link left with one zone is dissolved, as
 when the other zone is deleted.
 
+**Comparing the views.** The zone's **Compare views** tab, or `jarl zone
+diff adbraun.lol`, lines the views up and shows each name and type that
+differs: a view's own records, or a name one view lacks. **Use this
+version** (`jarl record update ID --shared`) makes one view's version
+every view's. It works for zones that aren't linked too, to see what
+linking them would keep local.
+
+```
+$ jarl zone diff adbraun.lol
+NAME  TYPE  INTERNAL                    EXTERNAL
+nas   A     10.0.10.20 [local, id 812]  203.0.113.20 [local, id 790]
+5 names and types differ, 21 are the same; linked
+```
+
+`--local` also works on a zone that isn't linked (its records are local
+anyway), so scripts don't need to know; `--shared` there is refused.
+
 **Permissions** are checked in every view a change reaches. A token with
 a grant for one view only (`views=internal`) can change that view's local
 records and make overrides, but not a shared record, since that would