Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/mkdeb.sh

@@ -6,12 +6,12 @@
 # The package installs, with Debian's paths:
 #   /usr/bin/jarld, /usr/bin/jarl
 #   /usr/share/bash-completion/completions/{jarl,jarld}
-#   /usr/lib/systemd/system/jarl.service
+#   /usr/lib/systemd/system/{jarl.service,jarl-backup.service,jarl-backup.timer}
 #   /usr/lib/sysusers.d/jarl.conf, /usr/lib/tmpfiles.d/jarl.conf
 #   /usr/share/doc/jarl/ (README, CHANGELOG, docs, contrib)
 # and its scripts (deploy/debian) create the jarl user and directories and
-# /etc/jarl/jarl.yaml on the first install, restart a running jarld on
-# upgrades, and stop it on removal. No file in /etc belongs to the package,
+# /etc/jarl/jarl.yaml on the first install, turn on the daily backup timer,
+# restart a running jarld on upgrades, and stop both on removal. No file in /etc belongs to the package,
 # so an upgrade never asks about configuration files.
 #
 # Variables: DEB_ARCH (Debian architecture, e.g. amd64, arm64, armhf),