Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_changes.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"net/http"
@@ -271,10 +272,55 @@ func (s *Server) status(w http.ResponseWriter, r *http.Request, p *auth.Principa
 			st.Named.Raw = ""
 		}
 	}
-	writeJSON(w, http.StatusOK, api.StatusResponse{Version: s.cfg.Version, Engine: raw(st), Time: time.Now()})
+	now := time.Now()
+	resp := api.StatusResponse{Version: s.cfg.Version, Engine: raw(st), Time: now, ExpiringTokens: s.expiringTokens(r.Context(), p, now)}
+	if p.IsAdmin() {
+		resp.Backup = s.backupStatus(r.Context(), now)
+	}
+	writeJSON(w, http.StatusOK, resp)
 	return nil
 }
 
+// backupStatus reports the newest backup, as 'jarld backup' recorded it,
+// and whether it is older than backup.warn_after. No backup at all is
+// reported but not flagged: backups may be made some other way.
+func (s *Server) backupStatus(ctx context.Context, now time.Time) *api.BackupStatus {
+	ok, failed := s.store.LastBackups(ctx)
+	bs := &api.BackupStatus{Dir: s.cfg.BackupDir, WarnAfter: int64(s.cfg.BackupWarnAfter / time.Second)}
+	if ok != nil {
+		bs.LastAt, bs.LastFile, bs.LastSize = &ok.At, ok.File, ok.Size
+		bs.Stale = s.cfg.BackupWarnAfter > 0 && now.Sub(ok.At) > s.cfg.BackupWarnAfter
+	}
+	if failed != nil && (ok == nil || failed.At.After(ok.At)) {
+		bs.LastError, bs.LastErrorAt = failed.Error, &failed.At
+	}
+	return bs
+}
+
+// expiringTokens lists the tokens the dashboard warns about: those that
+// expire within model.TokenExpiryWarning or expired less than that long
+// ago. Administrators see everyone's, others their own.
+func (s *Server) expiringTokens(ctx context.Context, p *auth.Principal, now time.Time) []api.Token {
+	out := []api.Token{}
+	uid := p.User.ID
+	if p.IsAdmin() {
+		uid = 0
+	} else if uid == 0 {
+		return out
+	}
+	ts, err := s.store.ListTokens(ctx, uid)
+	if err != nil {
+		s.log.Warn("listing tokens failed", "err", err)
+		return out
+	}
+	for _, t := range ts {
+		if t.ExpiresWithin(now, model.TokenExpiryWarning) && now.Sub(*t.ExpiresAt) < model.TokenExpiryWarning {
+			out = append(out, presentToken(t))
+		}
+	}
+	return out
+}
+
 func (s *Server) systemCheck(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
 	if err := require(p, auth.Action{Resource: auth.ResOptions}); err != nil {
 		return err