Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/install.md

@@ -43,22 +43,28 @@ for any architecture Go supports. apt also installs `bind9` (recommended)
 if it's missing. Installing the package:
 
 * puts the binaries in `/usr/bin`, bash completion in
-  `/usr/share/bash-completion/completions`, the systemd unit in
-  `/usr/lib/systemd/system/jarl.service`, the sysusers and tmpfiles files
+  `/usr/share/bash-completion/completions`, the systemd units in
+  `/usr/lib/systemd/system` (`jarl.service`, and `jarl-backup.service`
+  with its daily `jarl-backup.timer`), the sysusers and tmpfiles files
   in `/usr/lib`, and the docs and contrib files in `/usr/share/doc/jarl`;
 * creates the `jarl` user (in group `bind`) and Jarl's directories, and
   writes `/etc/jarl/jarl.yaml` from the example on the first install. No
   file in `/etc` belongs to the package, so your configuration is never
   replaced or asked about on upgrades;
+* turns on the daily database backup, `jarl-backup.timer`
+  ([operations.md](operations.md#backups)). It does nothing until the
+  database exists. If you turn it off (`systemctl disable
+  jarl-backup.timer`), upgrades leave it off;
 * doesn't start jarld: continue with [3. Configure](#3-configure), then
   `systemctl enable --now jarl` in step 8.
 
 **Upgrading**: build and install the newer package the same way. A running
 jarld is restarted, and upgrades its database as it starts.
 
-**Removing** (`sudo apt remove jarl`) stops jarld and removes the program,
-but named keeps running with the configuration Jarl last wrote. Even
-`apt purge jarl` keeps `/etc/jarl`, `/var/lib/jarl` (the database) and the
+**Removing** (`sudo apt remove jarl`) stops jarld and the backup timer and
+removes the program, but named keeps running with the configuration Jarl
+last wrote. Even `apt purge jarl` keeps `/etc/jarl`, `/var/lib/jarl` (the
+database), `/var/backups/jarl` and the
 files in `/etc/bind/jarl`, `/var/lib/bind/jarl` and `/var/cache/bind/jarl`,
 since named.conf may still include them. Remove them by hand once named no
 longer uses them.
@@ -78,8 +84,9 @@ This installs:
 | `/usr/local/bin/jarld`, `/usr/local/bin/jarl` | daemon and CLI |
 | `/usr/local/share/bash-completion/completions/jarl`, `.../jarld` | bash completion (loaded automatically by the `bash-completion` package) |
 | `/etc/systemd/system/jarl.service` | systemd unit (`Type=notify`, sandboxed) |
+| `/etc/systemd/system/jarl-backup.service`, `jarl-backup.timer` | the daily database backup ([operations.md](operations.md#backups)) |
 | `/usr/lib/sysusers.d/jarl.conf` | creates the `jarl` system user and adds it to group `bind` |
-| `/usr/lib/tmpfiles.d/jarl.conf` | creates `/etc/jarl`, `/var/lib/jarl`, `/etc/bind/jarl`, `/var/lib/bind/jarl`, `/var/cache/bind/jarl` |
+| `/usr/lib/tmpfiles.d/jarl.conf` | creates `/etc/jarl`, `/var/lib/jarl`, `/etc/bind/jarl`, `/var/lib/bind/jarl`, `/var/cache/bind/jarl`, `/var/backups/jarl` |
 | `/etc/jarl/jarl.yaml` | example configuration (only if none exists) |
 | `/usr/local/share/doc/jarl/` | these docs and the acme.sh hook |
 
@@ -90,19 +97,21 @@ systemd-sysusers jarl.conf
 systemd-tmpfiles --create jarl.conf
 chgrp jarl /etc/jarl/jarl.yaml
 systemctl daemon-reload
+systemctl enable --now jarl-backup.timer   # daily backups; idle until the database exists
 ```
 
 Without `make` (from a release tarball), the same steps are:
 
 ```sh
 install -m 0755 jarld jarl /usr/local/bin/
-install -m 0644 deploy/systemd/jarl.service /etc/systemd/system/
+install -m 0644 deploy/systemd/jarl.service deploy/systemd/jarl-backup.service deploy/systemd/jarl-backup.timer /etc/systemd/system/
 install -m 0644 deploy/sysusers.d/jarl.conf /usr/lib/sysusers.d/
 install -m 0644 deploy/tmpfiles.d/jarl.conf /usr/lib/tmpfiles.d/
 systemd-sysusers jarl.conf && systemd-tmpfiles --create jarl.conf
 jarld config --example > /etc/jarl/jarl.yaml
 chgrp jarl /etc/jarl/jarl.yaml && chmod 0640 /etc/jarl/jarl.yaml
 systemctl daemon-reload
+systemctl enable --now jarl-backup.timer
 ```
 
 ### Why the jarl user is in group bind
@@ -292,11 +301,12 @@ make && sudo make install
 sudo systemctl restart jarl
 ```
 
-Database migrations run automatically at startup. Before an upgrade, back
-up the database (it is safe while jarld runs):
+Database migrations run automatically at startup. Before an upgrade, take
+a backup (it is safe while jarld runs); `jarld restore` puts it back if
+needed:
 
 ```sh
-sudo -u jarl jarld backup /var/lib/jarl/jarl-$(date +%F).db
+sudo -u jarl jarld backup
 ```
 
 ## Uninstalling
@@ -304,10 +314,10 @@ sudo -u jarl jarld backup /var/lib/jarl/jarl-$(date +%F).db
 ```sh
 cp /etc/bind/named.conf.pre-jarl-<date> /etc/bind/named.conf   # or write a named.conf that includes Jarl's files
 rndc reconfig
-systemctl disable --now jarl
+systemctl disable --now jarl jarl-backup.timer
 make uninstall
 ```
 
 `/etc/bind/jarl` and `/var/lib/bind/jarl` contain plain named.conf and zone
-files that keep working without Jarl. `make uninstall` leaves them and
-Jarl's database in place.
+files that keep working without Jarl. `make uninstall` leaves them,
+Jarl's database and its backups in place.