Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/zone.js

@@ -14,6 +14,7 @@ export async function render(el, params, query) {
     ["settings", "Settings"],
     ["options", "Options"],
     zone.type === "primary" ? ["file", "Zone file"] : null,
+    ["primary", "secondary", "mirror"].includes(zone.type) ? ["servers", "Name servers"] : null,
   ].filter(Boolean);
   const body = h("div");
   mount(el,
@@ -34,6 +35,106 @@ export async function render(el, params, query) {
   else if (tab === "settings") await settingsTab(body, zone);
   else if (tab === "options") await optionsEditor(body, { scope: "zone", scope_id: zone.id, catalogScope: "zone:" + zone.type, title: "Zone options" });
   else if (tab === "file") await fileTab(body, zone);
+  else if (tab === "servers") await serversTab(body, zone);
+}
+
+// ---- name servers: serials on the other servers, and the delegation
+
+const nsStatus = {
+  self: ["this server", ""], in_sync: ["in sync", "ok"], answered: ["answers", "ok"],
+  behind: [null, "warn"], ahead: [null, "warn"], not_authoritative: ["doesn't serve the zone", "err"],
+  refused: ["refused", "err"], unreachable: ["no answer", "err"], no_route: ["no route from here", ""],
+  no_address: ["no address", "err"], error: ["error", "err"],
+};
+
+function nsBadge(r) {
+  let [text, kind] = nsStatus[r.status] || [r.status, "err"];
+  if (r.status === "behind") text = "behind by " + -r.diff;
+  if (r.status === "ahead") text = "ahead by " + r.diff;
+  return [badge(text, kind), r.error && r.status !== "unreachable" ? h("div", { class: "muted small" }, r.error) : null];
+}
+
+function nsTable(servers, withSource) {
+  return table([
+    { label: "Server", render: (r) => r.name ? display(r.name) : h("span", { class: "muted" }, "–"), tdClass: "mono" },
+    { label: "Address", render: (r) => (r.address || "–") + (r.port ? " port " + r.port : ""), tdClass: "mono small" },
+    withSource ? { label: "From", render: (r) => r.source, tdClass: "small" } : null,
+    { label: "Status", render: nsBadge },
+    { label: "Serial", render: (r) => r.serial ?? "–", tdClass: "mono" },
+    { label: "Time", render: (r) => r.rtt_ms ? r.rtt_ms + " ms" : "", tdClass: "small muted" },
+  ].filter(Boolean), servers, { empty: "No other name servers to ask." });
+}
+
+async function serversTab(el, zone) {
+  const serials = h("div");
+  const loadSerials = async () => {
+    mount(serials, h("div", { class: "muted" }, "Asking the name servers…"));
+    try {
+      const r = await get("/zones/" + zone.id + "/serials");
+      const src = { named: "served by named here", jarl: "Jarl's; named wasn't asked" }[r.serial_source];
+      mount(serials,
+        h("p", null, "This server: serial ", h("strong", { class: "mono" }, r.serial ?? "unknown"), src ? h("span", { class: "muted" }, " (" + src + ")") : null),
+        nsTable(r.servers, true),
+        r.notes.map((n) => h("p", { class: "muted small" }, n)),
+        h("p", { class: "muted small" }, "Checked ", time(r.checked_at), "."));
+    } catch (err) {
+      mount(serials, errorBox(err));
+    }
+  };
+  const parts = [h("div", { class: "panel" },
+    h("div", { class: "page-head" },
+      h("h2", { class: "grow" }, zone.type === "primary" ? "Serials on the secondaries" : "Serials on the primaries"),
+      h("button", { class: "small", onclick: loadSerials }, "Check again")),
+    h("p", { class: "muted small" }, zone.type === "primary"
+      ? "Asks the servers in the zone's NS records and its also-notify targets which serial they serve. A secondary that is behind hasn't picked up the latest change yet."
+      : "Asks the zone's primaries which serial they serve, to see whether this server's copy is up to date."),
+    serials)];
+  if (zone.type === "primary") {
+    const out = h("div");
+    const resolver = input({ placeholder: "the server's own" });
+    const run = async (e) => {
+      e.preventDefault();
+      mount(out, h("div", { class: "muted" }, "Asking the parent zone's servers…"));
+      try {
+        const q = resolver.value.trim() ? { resolver: resolver.value.trim() } : {};
+        mount(out, delegationReport(await get("/zones/" + zone.id + "/delegation", q)));
+      } catch (err) {
+        mount(out, errorBox(err));
+      }
+    };
+    parts.push(h("div", { class: "panel" },
+      h("h2", null, "Delegation from the parent zone"),
+      h("p", { class: "muted small" }, "For zones on the internet: checks that the parent zone (for adbraun.lol, \"lol\") points to this zone's name servers with the right glue addresses, and that each of them serves the zone. A zone used only on your own network isn't delegated, and doesn't need this."),
+      h("form", { class: "inline-form", onsubmit: run },
+        h("div", { class: "f" }, h("label", null, "Resolver (optional)"), resolver),
+        h("div", { class: "f" }, h("label", null, " "), h("button", { type: "submit" }, "Check delegation"))),
+      out));
+  }
+  mount(el, parts);
+  await loadSerials();
+}
+
+function delegationReport(r) {
+  const lvl = { ok: "ok", info: "", warning: "warn", error: "err" };
+  const parents = {};
+  for (const p of r.parent_servers) {
+    const say = p.status === "delegated" ? "delegate to " + p.ns.map(display).join(", ") : p.status === "not_delegated" ? "no delegation" : p.status + (p.error ? ": " + p.error : "");
+    (parents[say] = parents[say] || []).push(display(p.name));
+  }
+  return [
+    r.parent ? h("p", null, "Parent zone ", h("strong", { class: "mono" }, display(r.parent)), h("span", { class: "muted" }, " (found through " + r.resolver + ")")) : null,
+    Object.keys(parents).length ? h("ul", { class: "small" }, Object.entries(parents).map(([say, who]) =>
+      h("li", null, who.length > 1 ? who[0] + " and " + (who.length - 1) + " more: " : who[0] + ": ", say))) : null,
+    h("div", null, r.findings.map((f) => h("div", { class: "msg " + lvl[f.level] }, f.message))),
+    r.glue.length ? table([
+      { label: "Glue for", render: (g) => display(g.name), tdClass: "mono" },
+      { label: "Parent", render: (g) => g.parent.join(", ") || "none", tdClass: "mono small" },
+      { label: "Zone", render: (g) => g.jarl.join(", ") || "none", tdClass: "mono small" },
+      { label: "", render: (g) => g.match ? badge("matches", "ok") : badge("differs", "warn") },
+    ], r.glue) : null,
+    r.servers.length ? [h("h3", null, "Delegated name servers"), nsTable(r.servers, false)] : null,
+    r.notes.map((n) => h("p", { class: "muted small" }, n)),
+  ];
 }
 
 async function deleteZone(zone) {