Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/store.go

@@ -54,6 +54,24 @@ func Open(path string) (*Store, error) {
 	return s, nil
 }
 
+// OpenExisting opens an existing database without creating it or
+// applying migrations, for commands that work alongside a running jarld
+// that may be older than they are ('jarld backup').
+func OpenExisting(path string) (*Store, error) {
+	db, err := sql.Open("sqlite", "file:"+path+"?mode=rw&_pragma=busy_timeout(10000)&_pragma=foreign_keys(1)&_txlock=immediate")
+	if err != nil {
+		return nil, err
+	}
+	if err := db.Ping(); err != nil {
+		db.Close()
+		return nil, err
+	}
+	return &Store{db: db}, nil
+}
+
+// SchemaVersion is the database schema version this Jarl uses.
+func SchemaVersion() int { return len(migrations) }
+
 // Close closes the database.
 func (s *Store) Close() error { return s.db.Close() }
 
@@ -369,3 +387,48 @@ func boolInt(b bool) int {
 func placeholders(n int) string {
 	return strings.TrimSuffix(strings.Repeat("?,", n), ",")
 }
+
+// BackupRecord is a backup that 'jarld backup' made (or failed to make),
+// kept in the meta table for the dashboard.
+type BackupRecord struct {
+	At    time.Time `json:"at"`
+	File  string    `json:"file,omitempty"`
+	Size  int64     `json:"size,omitempty"`
+	Error string    `json:"error,omitempty"`
+}
+
+const (
+	metaBackupOK     = "backup.last_ok"
+	metaBackupFailed = "backup.last_failed"
+)
+
+// RecordBackup stores the outcome of a backup: r.Error empty for a
+// successful one.
+func (s *Store) RecordBackup(ctx context.Context, r BackupRecord) error {
+	key := metaBackupOK
+	if r.Error != "" {
+		key = metaBackupFailed
+	}
+	b, err := json.Marshal(r)
+	if err != nil {
+		return err
+	}
+	return s.SetMeta(ctx, key, string(b))
+}
+
+// LastBackups returns the newest successful and failed backups (nil for
+// none).
+func (s *Store) LastBackups(ctx context.Context) (ok, failed *BackupRecord) {
+	get := func(key string) *BackupRecord {
+		v, err := s.GetMeta(ctx, key)
+		if err != nil {
+			return nil
+		}
+		var r BackupRecord
+		if json.Unmarshal([]byte(v), &r) != nil {
+			return nil
+		}
+		return &r
+	}
+	return get(metaBackupOK), get(metaBackupFailed)
+}