Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/types.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"jarl/internal/model"
+	"jarl/internal/nscheck"
 )
 
 // Version is the API path prefix.
@@ -151,6 +152,34 @@ type StatusResponse struct {
 	Version string          `json:"version"`
 	Engine  json.RawMessage `json:"engine"`
 	Time    time.Time       `json:"time"`
+	// ExpiringTokens are tokens that expire within TokenExpiryWarning or
+	// expired less than that long ago (not revoked): every user's for
+	// administrators, otherwise the caller's own.
+	ExpiringTokens []Token `json:"expiring_tokens"`
+	// Backup is the state of database backups (administrators only).
+	Backup *BackupStatus `json:"backup,omitempty"`
+}
+
+// TokenExpiresHeader is sent with responses to a token that expires
+// soon (model.TokenExpiryWarning), holding its expiry time (RFC 3339). The
+// CLI warns its user when it sees it.
+const TokenExpiresHeader = "Jarl-Token-Expires"
+
+// BackupStatus describes the newest database backup, as recorded by
+// 'jarld backup'.
+type BackupStatus struct {
+	LastAt    *time.Time `json:"last_at,omitempty"`
+	LastFile  string     `json:"last_file,omitempty"`
+	LastSize  int64      `json:"last_size,omitempty"`
+	LastError string     `json:"last_error,omitempty"`
+	// LastErrorAt is when the newest failed backup ran (only reported
+	// when it is newer than the last success).
+	LastErrorAt *time.Time `json:"last_error_at,omitempty"`
+	Dir         string     `json:"dir"`
+	// WarnAfter (seconds) is how old the newest backup may get before
+	// Stale is set (0: never).
+	WarnAfter int64 `json:"warn_after"`
+	Stale     bool  `json:"stale"`
 }
 
 // SearchResult is one search hit.
@@ -215,3 +244,26 @@ type ZoneImport struct {
 	// UseSOA also takes the SOA timers and default TTL from the file.
 	UseSOA bool `json:"use_soa,omitempty"`
 }
+
+// SerialsResponse is GET /zones/{zone}/serials.
+type SerialsResponse struct {
+	Zone string `json:"zone"`
+	View string `json:"view,omitempty"`
+	Type string `json:"type"`
+	// Serial is what this server serves: named's loaded serial, or for a
+	// primary zone Jarl's when named can't be asked (SerialSource says
+	// which).
+	Serial       *uint32          `json:"serial"`
+	SerialSource string           `json:"serial_source,omitempty"`
+	Servers      []nscheck.Result `json:"servers"`
+	Notes        []string         `json:"notes"`
+	CheckedAt    time.Time        `json:"checked_at"`
+}
+
+// DelegationResponse is GET /zones/{zone}/delegation.
+type DelegationResponse struct {
+	*nscheck.DelegationReport
+	View      string    `json:"view,omitempty"`
+	Notes     []string  `json:"notes"`
+	CheckedAt time.Time `json:"checked_at"`
+}