Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/debian/postinst

@@ -18,8 +18,26 @@ if [ "$1" = configure ]; then
 		mv /etc/jarl/jarl.yaml.dpkg-new /etc/jarl/jarl.yaml
 	fi
 
+	# The daily database backup (jarl-backup.timer) is on by default. An
+	# administrator's 'systemctl disable jarl-backup.timer' is remembered
+	# by deb-systemd-helper and kept across upgrades. Before 'jarld init'
+	# the backup skips itself (there is no database yet).
+	if command -v deb-systemd-helper >/dev/null 2>&1; then
+		deb-systemd-helper unmask jarl-backup.timer >/dev/null || true
+		if deb-systemd-helper --quiet was-enabled jarl-backup.timer; then
+			deb-systemd-helper enable jarl-backup.timer >/dev/null || true
+		else
+			deb-systemd-helper update-state jarl-backup.timer >/dev/null || true
+		fi
+	elif [ -z "$2" ] && [ -d /run/systemd/system ]; then
+		systemctl enable jarl-backup.timer >/dev/null 2>&1 || true
+	fi
+
 	if [ -d /run/systemd/system ]; then
 		systemctl daemon-reload || true
+		if systemctl is-enabled --quiet jarl-backup.timer 2>/dev/null; then
+			systemctl start jarl-backup.timer || true
+		fi
 		# An upgrade restarts a running jarld (its database is upgraded
 		# when it starts). A first install starts nothing: Jarl needs
 		# 'jarld init' and 'jarld adopt' first.