Encrypted DNS health, comparing a zone's views, --local everywhere

jarld checks the DoT and DoH listeners every 10 minutes as a client would (page, dashboard, jarl encrypted-dns health, jarl_encrypted_dns_up). The Compare views tab and jarl zone diff show what differs between a zone's views, with Use this version. --local works on unlinked zones. A changed certificates.dir is followed by encrypted DNS's tls statements. Sharing an already shared version replaces other views' overrides.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/metrics.go

@@ -289,6 +289,13 @@ func (s *Server) collectState(ctx context.Context, pw *promWriter, now time.Time
 		}
 	}
 
+	if h := s.encryptedDNSHealth(); h != nil {
+		for _, pr := range h.Probes {
+			pw.gauge("jarl_encrypted_dns_up", "1 when the DNS over TLS or HTTPS listener answered with the right, current certificate at the last check (every 10 minutes).", b2f(pr.OK),
+				"kind", pr.Kind, "address", pr.Address, "port", strconv.Itoa(pr.Port))
+		}
+	}
+
 	if tokens, err := s.store.ListTokens(ctx, 0); err == nil {
 		for _, t := range tokens {
 			if t.ExpiresAt != nil && t.RevokedAt == nil {