Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Makefile

@@ -4,7 +4,7 @@
 #   make test         unit tests (integration tests run when BIND is found;
 #                     set JARL_BIND_ROOT, see docs/development.md)
 #   make e2e          end-to-end test against a real named (scripts/e2e.sh)
-#   sudo make install install binaries, bash completion, systemd unit,
+#   sudo make install install binaries, bash completion, systemd units,
 #                     sysusers/tmpfiles files and an example /etc/jarl/jarl.yaml
 #   make deb          a Debian package in dist/ (DEB_ARCH=arm64 for another
 #                     architecture); install it with 'sudo apt install ./dist/jarl_*.deb'
@@ -69,7 +69,8 @@ install: build install-files
 	@echo
 	@echo "Next (as root): systemd-sysusers jarl.conf && systemd-tmpfiles --create jarl.conf"
 	@echo "                chgrp jarl /etc/jarl /etc/jarl/jarl.yaml && systemctl daemon-reload"
-	@echo "Then follow docs/install.md (init, import, adopt, start)."
+	@echo "Then follow docs/install.md (init, import, adopt, start), and turn on the daily"
+	@echo "database backup:  systemctl enable --now jarl-backup.timer"
 
 # Everything but /etc/jarl/jarl.yaml (shared by install and deb).
 install-files:
@@ -77,8 +78,10 @@ install-files:
 	install -D -m 0755 $(JARL_BIN) $(DESTDIR)$(BINDIR)/jarl
 	install -D -m 0644 bin/completion/jarl $(DESTDIR)$(BASHCOMPDIR)/jarl
 	install -D -m 0644 bin/completion/jarld $(DESTDIR)$(BASHCOMPDIR)/jarld
-	install -D -m 0644 deploy/systemd/jarl.service $(DESTDIR)$(UNITDIR)/jarl.service
-	sed -i 's#/usr/local/bin/jarld#$(BINDIR)/jarld#; s#/usr/local/share/doc/jarl#$(DOCDIR)#' $(DESTDIR)$(UNITDIR)/jarl.service
+	for u in jarl.service jarl-backup.service jarl-backup.timer; do \
+		install -D -m 0644 deploy/systemd/$$u $(DESTDIR)$(UNITDIR)/$$u && \
+		sed -i 's#/usr/local/bin/jarld#$(BINDIR)/jarld#; s#/usr/local/share/doc/jarl#$(DOCDIR)#' $(DESTDIR)$(UNITDIR)/$$u || exit 1; \
+	done
 	install -D -m 0644 deploy/sysusers.d/jarl.conf $(DESTDIR)$(SYSUSERSDIR)/jarl.conf
 	install -D -m 0644 deploy/tmpfiles.d/jarl.conf $(DESTDIR)$(TMPFILESDIR)/jarl.conf
 	install -D -m 0644 README.md $(DESTDIR)$(DOCDIR)/README.md
@@ -91,10 +94,11 @@ install-files:
 
 uninstall:
 	rm -f $(DESTDIR)$(BINDIR)/jarld $(DESTDIR)$(BINDIR)/jarl $(DESTDIR)$(UNITDIR)/jarl.service \
+		$(DESTDIR)$(UNITDIR)/jarl-backup.service $(DESTDIR)$(UNITDIR)/jarl-backup.timer \
 		$(DESTDIR)$(BASHCOMPDIR)/jarl $(DESTDIR)$(BASHCOMPDIR)/jarld \
 		$(DESTDIR)$(SYSUSERSDIR)/jarl.conf $(DESTDIR)$(TMPFILESDIR)/jarl.conf
 	rm -rf $(DESTDIR)$(DOCDIR)
-	@echo "Kept /etc/jarl, /var/lib/jarl and the files in /etc/bind/jarl and /var/lib/bind/jarl."
+	@echo "Kept /etc/jarl, /var/lib/jarl, /var/backups/jarl and the files in /etc/bind/jarl and /var/lib/bind/jarl."
 
 # A Debian package, built with dpkg-deb (no root needed). The package's
 # scripts are in deploy/debian; scripts/mkdeb.sh explains the layout.