Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/api.md

@@ -39,6 +39,10 @@ sudo curl --unix-socket /run/jarl/jarl.sock http://localhost/api/v1/status
 **HTTP Basic**, only on the lego `httpreq` routes (below): the username is
 the token's user and the password the API token.
 
+A response to a token that expires within 14 days carries
+`Jarl-Token-Expires: <RFC 3339 time>`; the `jarl` CLI warns when it sees
+it. Every response has `Server: Jarl/<version>`.
+
 ## Errors
 
 ```http
@@ -138,6 +142,8 @@ may be the name.
 | PATCH | `/zones/{zone}` | ZoneInput (only the fields to change) |
 | DELETE | `/zones/{zone}` | deletes the zone with its records and options |
 | GET | `/zones/{zone}/file` | the generated zone file (text/plain) |
+| GET | `/zones/{zone}/serials` | asks the zone's other name servers for their serial (below) |
+| GET | `/zones/{zone}/delegation` | checks the parent zone's delegation of a primary zone (below); `?resolver=IP` |
 | POST | `/zones/{zone}/import` | `{"text": "<zone file>", "mode": "merge"\|"replace", "use_soa": false, "dry_run": false}` |
 
 ZoneInput:
@@ -162,6 +168,36 @@ ZoneInput:
 }
 ```
 
+`/serials` and `/delegation` send DNS queries from the server, and only
+when called ([operations.md](operations.md#checking-name-servers-and-the-delegation)).
+`/serials` works for primary, secondary and mirror zones:
+
+```json
+{
+  "zone": "adbraun.lol.", "view": "", "type": "primary",
+  "serial": 2026100814, "serial_source": "named",    // or "jarl" when named can't be asked
+  "servers": [
+    {"name": "ns1.adbraun.lol.", "address": "192.168.1.53", "source": "NS record", "status": "self", "serial": 2026100814},
+    {"name": "ns2.adbraun.lol.", "address": "192.168.1.54", "source": "NS record", "status": "behind",
+     "serial": 2026100812, "diff": -2, "rtt_ms": 1}
+  ],
+  "notes": [], "checked_at": "..."
+}
+```
+
+`status` is `self`, `in_sync`, `answered` (no serial here to compare),
+`behind`, `ahead`, `not_authoritative`, `refused`, `unreachable`,
+`no_route` (no route from this server, e.g. IPv6), `no_address` or
+`error` (with `error`). `source` is `NS record`, `also-notify` or
+`primaries`; `port` is set for a non-default port.
+
+`/delegation` returns `parent`, `resolver`, `delegated`, `parent_ns`,
+`jarl_ns`, `parent_servers` (each parent server's `status`: `delegated`,
+`not_delegated`, `unreachable`, `error`, with `ns` and `glue`), `glue`
+(`name`, `parent`, `jarl`, `match`), `servers` (as above, for the delegated
+name servers) and `findings`: `{"level": "ok"|"info"|"warning"|"error",
+"message": "..."}`. A zone that isn't delegated gets one `info` finding.
+
 ### Records
 
 | Method | Path | Body / query |
@@ -274,7 +310,7 @@ in it and its records.
 
 | Method | Path | Notes |
 |--------|------|-------|
-| GET | `/status` | named status, adoption, drift, open changesets, current problems, object counts |
+| GET | `/status` | named status, adoption, drift, open changesets, current problems, object counts; `expiring_tokens` (tokens that expire within 14 days or expired in the last 14: all for administrators, otherwise the caller's); `backup` (administrators: `last_at`, `last_file`, `last_size`, `last_error`, `last_error_at`, `dir`, `warn_after` in seconds, `stale`) |
 | POST | `/system/check` | validation + named-checkconf of the current configuration (`options:read`) |
 | POST | `/system/resync` | `{"dry_run": false, "force": false}`: rewrite every file from the database and reload (admin) |
 | GET | `/audit` | `?user=&action=&outcome=&object_type=&changeset=&q=&since=&until=&limit=200&before=ID` |