Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -38,11 +38,19 @@ error: www.adbraun.lol has a CNAME, so it can't have any other records (found A)
   Serials are bumped automatically.
 * **Users and API tokens with granular permissions**, e.g. a token that may
   only write `_acme-challenge` TXT records in one zone. Tokens can be
-  rotated (a new secret, same grants), with an optional grace period.
+  rotated (a new secret, same grants), with an optional grace period, and
+  Jarl warns two weeks before one expires (dashboard, log, and the CLI
+  using it).
   Passwords use argon2id, sessions have CSRF protection, logins are rate
   limited.
 * **Audit log** of every login, change and token, with user, token, IP and
   outcome.
+* **Daily backups** of the database by a systemd timer, checked as they are
+  written, with retention that never deletes the last few; `jarld restore`
+  puts one back safely.
+* **Name server checks**: whether the secondaries serve the current serial,
+  and, for zones on the internet, whether the parent zone delegates them
+  to the right name servers with the right glue.
 * **No token needed on the server**: root's `sudo jarl ...` talks to jarld
   over a local unix socket, so a lost token or password never locks you
   out.