Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/config/config.go

@@ -31,10 +31,28 @@ type Config struct {
 	Session    Session `yaml:"session"`
 	BIND       BIND    `yaml:"bind"`
 	Audit      Audit   `yaml:"audit"`
+	Backup     Backup  `yaml:"backup"`
 	Stats      Stats   `yaml:"stats"`
 	ACME       ACME    `yaml:"acme"`
 }
 
+// Backup configures 'jarld backup' run without a file name, which is what
+// the jarl-backup.timer systemd timer runs (daily by default; the schedule
+// is the timer's OnCalendar=). Each run writes a new backup into Dir and
+// then deletes the ones Retention and KeepAtLeast no longer want.
+type Backup struct {
+	Dir string `yaml:"dir"`
+	// Retention deletes backups older than this (0 keeps them all)...
+	Retention Duration `yaml:"retention"`
+	// ...but the newest KeepAtLeast are always kept, however old.
+	KeepAtLeast int `yaml:"keep_at_least"`
+	// Stats also backs up the query statistics database.
+	Stats bool `yaml:"stats"`
+	// WarnAfter makes the dashboard warn when the newest backup is older
+	// than this (0: never). Keep it above the timer's interval.
+	WarnAfter Duration `yaml:"warn_after"`
+}
+
 // ACME configures the ACME helpers.
 type ACME struct {
 	HTTPReq HTTPReq `yaml:"httpreq"`
@@ -197,7 +215,8 @@ func Default() *Config {
 			Retention:         StatsRetention{Minute: Duration(7 * 24 * time.Hour), Hour: Duration(90 * 24 * time.Hour), Day: Duration(730 * 24 * time.Hour)},
 			TopN:              100,
 		},
-		ACME: ACME{HTTPReq: HTTPReq{RequireHTTPS: true}},
+		ACME:   ACME{HTTPReq: HTTPReq{RequireHTTPS: true}},
+		Backup: Backup{Dir: "/var/backups/jarl", Retention: Duration(30 * 24 * time.Hour), KeepAtLeast: 7, WarnAfter: Duration(2 * 24 * time.Hour)},
 	}
 }
 
@@ -251,6 +270,9 @@ func (c *Config) check() error {
 	if err := c.Stats.check(); err != nil {
 		return fmt.Errorf("stats: %w", err)
 	}
+	if err := c.Backup.check(); err != nil {
+		return fmt.Errorf("backup: %w", err)
+	}
 	switch c.Log.Format {
 	case "text", "json":
 	default:
@@ -259,6 +281,22 @@ func (c *Config) check() error {
 	return nil
 }
 
+func (b *Backup) check() error {
+	if b.Dir == "" || !filepath.IsAbs(b.Dir) {
+		return fmt.Errorf("dir must be an absolute path")
+	}
+	if b.Retention < 0 || (b.Retention > 0 && b.Retention < Duration(24*time.Hour)) {
+		return fmt.Errorf("retention must be at least 1d (or 0 to keep every backup)")
+	}
+	if b.KeepAtLeast < 1 {
+		return fmt.Errorf("keep_at_least must be at least 1")
+	}
+	if b.WarnAfter < 0 || (b.WarnAfter > 0 && b.WarnAfter < Duration(time.Hour)) {
+		return fmt.Errorf("warn_after must be at least 1h (or 0 for no warning)")
+	}
+	return nil
+}
+
 func (s *Stats) check() error {
 	if !s.Enabled {
 		return nil
@@ -391,6 +429,19 @@ audit:
   # Delete audit events older than this many days (0 keeps them forever).
   retention_days: 0
 
+# Database backups (docs/operations.md#backups). The jarl-backup.timer
+# systemd timer runs 'jarld backup' daily; change when with
+# 'systemctl edit jarl-backup.timer'. Each run writes
+# DIR/jarl-<UTC time>.db, checks it, then deletes backups older than
+# 'retention', always keeping the newest 'keep_at_least'. Only files named
+# like that are ever deleted. Restore with 'jarld restore'.
+backup:
+  dir: /var/backups/jarl   # the timer's sandbox may write only here (see the docs to move it)
+  retention: 30d           # 0 keeps every backup
+  keep_at_least: 7
+  stats: false             # also back up the statistics database
+  warn_after: 2d           # dashboard warning when the newest backup is older (0: never)
+
 # Query statistics (docs/stats.md). Off by default. When enabled, Jarl makes
 # named publish its counters on a local statistics channel and log every
 # response, and jarld aggregates both into a separate database. Changing