Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -135,6 +135,7 @@ to stderr with `-o json` or `-o yaml`, so stdout holds just the documents.
 |------|---------|
 | 0 | Success |
 | 1 | Other error (bad arguments, connection failure, ...) |
+| 2 | A check found problems (`zone serials`, `zone delegation`); its report was printed |
 | 3 | Not authenticated, or not allowed (token lacks the permission) |
 | 4 | Not found |
 | 5 | Conflict: concurrent change, object in use, drift |
@@ -167,6 +168,8 @@ jarl zone update adbraun.lol --move-to-view internal
 jarl zone delete lab.adbraun.lol [-y]
 jarl zone file adbraun.lol                             # the generated zone file
 jarl zone import adbraun.lol db.adbraun.lol [--replace] [--use-soa]
+jarl zone serials adbraun.lol                          # are the secondaries (or primaries) on the current serial?
+jarl zone delegation adbraun.lol [--resolver 9.9.9.9]  # does the parent zone delegate it correctly?
 ```
 
 Reverse names follow the dots (the nibbles in IPv6), so a reverse zone
@@ -185,6 +188,14 @@ are deleted. Try it with `--dry-run` first. `--option "NAME VALUE"` on
 When a zone exists in several views, add `--view NAME` to commands that
 name it.
 
+`zone serials` asks the zone's other name servers which serial they serve
+(the NS records and also-notify targets of a primary zone, the primaries
+of a secondary) and exits with 2 if one isn't on the current serial.
+`zone delegation` is for zones on the internet: it checks the parent
+zone's delegation and glue against the zone, and calls a zone that isn't
+delegated (an internal-only zone) a note, not a problem. Both only run when
+you run them; see [operations.md](operations.md#checking-name-servers-and-the-delegation).
+
 ## Records
 
 ```sh
@@ -312,6 +323,7 @@ jarl user update bob --disabled                        # logs bob out, blocks hi
 jarl user delete bob -y
 
 jarl token list [--user alice | --all] [--revoked]
+jarl token list --all --expiring [60d]                 # expiring within 14 days (or 60d), or expired
 jarl token create laptop --expires 365d
 jarl token create backup-script --grant "*:read"
 jarl token create acme --user certbot --role acme
@@ -321,13 +333,18 @@ jarl token revoke 7
 
 jarl audit [--user alice] [--action auth.login_failed] [--outcome failure] [--since 2026-10-01] [--limit 100]
 jarl search 192.168.1.20
-jarl status          # named, adoption, drift, open changesets, problems
+jarl status          # named, adoption, drift, open changesets, backups, expiring tokens, problems
 jarl check           # validation + named-checkconf of the current configuration
 jarl resync [--force] [--dry-run]   # rewrite every file from the database
 ```
 
 Grant syntax, roles and token rotation are in [permissions.md](permissions.md).
 
+When the token `jarl` uses expires within 14 days, every command prints a
+warning on stderr (once), naming the expiry and how to rotate it. Scripts
+such as certbot hooks show it in their logs well before the token stops
+working.
+
 ## Query statistics
 
 ```sh