Multi-server CLI, more reverse zones, and a fix for new view directories

- CLI: name several servers and groups in the config file; select them
  with -s/--server NAME|GROUP|all|URL or JARL_SERVER. A command aimed at
  several servers is dry-run on all of them first and only runs if every
  one accepts it. Named servers always use their own token.
- Reverse zones: /32 and /128 get single-address zones; networks between
  octet or nibble boundaries (e.g. a /22) are covered by several zones
  created together, from the CLI and the web UI.
- Fix: under jarl.service's RestrictSUIDSGID, creating a view directory
  failed on chmod with the setgid bit; fall back to the permission bits.
- Web UI: the review/live switch is a small header button, and the
  pending-changes bar only shows when there are pending changes.
- TSIG key wording; the keys page points to restricted API tokens.
- Docs: several servers (cli.md), a secondary server (operations.md),
  tokens vs TSIG keys (permissions.md); CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -10,6 +10,21 @@ The first version, to be released as 0.1.0.
 
 ### Added
 
+- CLI: several servers in one configuration file. Name them
+  (`jarl config server add ns1 URL`), pick one with `-s/--server NAME` or
+  `JARL_SERVER`, set a default with `jarl config use`, and group them
+  (`jarl config group set dns ns1 ns2`). A command aimed at a group (or
+  `all`) is first checked on every server as a dry run and only runs if it
+  succeeds everywhere, so a change one server rejects changes nothing
+  anywhere. Named servers always use their own token.
+- Reverse zones for any network: a /32 (or /128) gets a zone that answers
+  for just that address, and a network between octet (or nibble)
+  boundaries, such as a /22, is covered by several zones (four /24s) that
+  are created together, from the CLI (`jarl zone create 10.0.8.0/22`) and
+  the web UI. Networks smaller than a /24 explain that they belong in the
+  enclosing /24's zone.
+- docs/operations.md: setting up a secondary server with its own jarld.
+
 - A logo: a Viking jarl drawn like a woodcut, with a spear-pointed crown
   that holds a DNS tree (a root node and its branches), a stern face and a
   full carved beard. White on a Nordic-blue disc (`assets/logo.svg`), plus an all-white
@@ -116,6 +131,13 @@ The first version, to be released as 0.1.0.
 
 ### Changed
 
+- Web UI: the review/live switch is a small "Review edits" / "Live edits"
+  button in the header, and the bar below it only appears while there are
+  pending changes.
+- TSIG keys: the name help no longer calls `xfer-key` a domain name (any
+  letters, digits, hyphens and dots will do; both servers must use the same
+  name), and the keys page points to restricted API tokens for giving
+  scripts or people limited access to zones and records.
 - Web UI, new zone dialog: choose **Domain** or **Reverse zone**. For a
   reverse zone you give the network (10.10.0.0/24, 2001:db8:1::/48) and the
   zone name is generated. Either way the dialog shows the exact zone name it
@@ -141,6 +163,11 @@ The first version, to be released as 0.1.0.
 
 ### Fixed
 
+- Under the shipped systemd unit (`RestrictSUIDSGID=yes`), the first zone
+  in a new view failed with "chmod /var/lib/bind/jarl/VIEW: operation not
+  permitted": setting the setgid bit on the new directory is refused there.
+  Jarl now falls back to the permission bits, so the directory is
+  group-writable for named, and only changes the mode when it needs to.
 - Web UI: the "Jarl 0.1.0" brand link no longer underlines the gap between
   the name and the version on hover.
 - Web UI: creating a zone from the dashboard's "New zone" link no longer