Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -10,6 +10,40 @@ The first version, to be released as 0.1.0.
 
 ### Added
 
+- Daily database backups: the `jarl-backup.timer` systemd timer (turned on
+  by the Debian package) runs `jarld backup`, which writes
+  `jarl-<UTC time>.db` into `backup.dir` (`/var/backups/jarl`), checks it
+  with SQLite's integrity check before giving it that name, and deletes
+  backups older than `backup.retention` (30d) while always keeping the
+  newest `backup.keep_at_least` (7). Ages come from the names, and only
+  files named like backups are ever deleted. Settings are in the new
+  `backup:` section of jarl.yaml; the schedule is the timer's. The dashboard
+  and `jarl status` show the newest backup, and warn when it is older than
+  `backup.warn_after` (2d) or the last attempt failed. `backup.stats` also
+  backs up the statistics database.
+- `jarld restore [FILE | latest]`: lists backups, or checks one, shows what
+  it holds next to the current database, and after confirmation replaces
+  the database with it, keeping the current one as
+  `jarl.db.before-restore-<time>`. It refuses while jarld runs: `jarld
+  serve` now holds a lock (`jarl.db.lock`), which also stops two jarlds from
+  using the same database. docs/operations.md explains restoring.
+- Warnings before API tokens expire, from 14 days ahead: on the dashboard,
+  in token lists ("soon", "expired"), once a day in jarld's log, and from
+  the `jarl` CLI on stderr whenever it uses such a token (responses carry a
+  `Jarl-Token-Expires` header). `jarl token list --expiring [WITHIN]` lists
+  them.
+- `jarl zone serials ZONE` and the zone page's Name servers tab: ask the
+  zone's other name servers which serial they serve (a primary zone's NS
+  records and also-notify targets, a secondary zone's primaries, with their
+  ports and TSIG keys) and compare it with this server's. Exits with 2 when
+  one is behind or doesn't answer.
+- `jarl zone delegation ZONE` and a button on the Name servers tab: for
+  zones on the internet, checks that the parent zone delegates the zone to
+  the name servers in its NS records, with matching glue, and that each of
+  them serves it. An undelegated (internal-only) zone gets one calm note.
+  Neither check runs unless asked.
+- jarld sends `Server: Jarl/<version>`.
+- CLI exit code 2: a check ran and found problems.
 - CLI: several servers in one configuration file. Name them
   (`jarl config server add ns1 URL`), pick one with `-s/--server NAME` or
   `JARL_SERVER`, set a default with `jarl config use`, and group them