Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/dashboard.js

@@ -1,4 +1,4 @@
-import { h, mount, time, problemsList, badge, plural } from "../ui.js";
+import { h, mount, time, relTime, problemsList, badge, plural } from "../ui.js";
 import { get, state } from "../api.js";
 
 export async function render(el) {
@@ -14,6 +14,7 @@ export async function render(el) {
       s.adopted ? "named loads Jarl's configuration" : "named does not load Jarl's configuration yet — run 'jarld adopt' on the server"),
     card("Zones", (s.counts || {}).zones ?? "–", plural((s.counts || {}).records || 0, "record") + " · " + plural((s.counts || {}).views || 0, "view")),
     card("Access", plural((s.counts || {}).acls || 0, "ACL"), plural((s.counts || {}).tsig_keys || 0, "TSIG key") + " · " + plural((s.counts || {}).options || 0, "option")),
+    st.backup ? backupCard(st.backup) : null,
   );
   const last = s.last_applied;
   const parts = [h("div", { class: "page-head" },
@@ -28,6 +29,26 @@ export async function render(el) {
       s.drift.map((d) => d.path + " (" + d.reason + ")").join(", "),
       h("div", { class: "small" }, "The next apply refuses to overwrite them unless forced. An administrator can rewrite them with 'jarld resync' (or System → Resync).")));
   }
+  const b = st.backup;
+  if (b && b.stale) {
+    parts.push(h("div", { class: "msg warn" },
+      h("strong", null, "The newest backup is " + relTime(b.last_at).replace(" ago", "") + " old. "),
+      "Backups should run daily: check 'systemctl status jarl-backup.timer' and 'journalctl -u jarl-backup' on the server."));
+  }
+  if (b && b.last_error) {
+    parts.push(h("div", { class: "msg err" },
+      h("strong", null, "The last backup failed "), time(b.last_error_at), ": " + b.last_error,
+      h("div", { class: "small" }, "See 'journalctl -u jarl-backup' on the server.")));
+  }
+  const exp = st.expiring_tokens || [];
+  if (exp.length) {
+    const now = new Date();
+    parts.push(h("div", { class: "msg warn" },
+      h("strong", null, exp.length === 1 ? "An API token expires soon: " : "API tokens expire soon: "),
+      exp.map((t, i) => [i ? ", " : "", h("a", { href: state.me.admin ? "#/users" : "#/account" }, t.username + "/" + t.name), " ",
+        new Date(t.expires_at) < now ? h("span", null, "expired ", time(t.expires_at)) : h("span", null, "expires ", time(t.expires_at))]),
+      h("div", { class: "small" }, "Rotate a token to give it a new lifetime and secret, keeping its permissions (API tokens → Rotate, or 'jarl token rotate'). Then update whatever uses it.")));
+  }
   parts.push(h("div", { class: "panel" },
     h("h2", null, "Last change"),
     last ? h("div", null,
@@ -50,6 +71,15 @@ export async function render(el) {
   mount(el, parts);
 }
 
+function backupCard(b) {
+  let value;
+  if (b.last_error) value = badge("failed", "err");
+  else if (!b.last_at) value = badge("none yet", "");
+  else value = badge(relTime(b.last_at), b.stale ? "warn" : "ok");
+  const sub = b.last_at ? h("span", { class: "mono small", title: b.last_file }, b.last_file.split("/").pop()) : "jarl-backup.timer writes to " + b.dir;
+  return card("Backup", value, sub);
+}
+
 function card(label, value, sub) {
   return h("div", { class: "card" }, h("div", { class: "label" }, label), h("div", { class: "value" }, value), sub ? h("div", { class: "sub" }, sub) : null);
 }