Multi-server CLI, more reverse zones, and a fix for new view directories

- CLI: name several servers and groups in the config file; select them
  with -s/--server NAME|GROUP|all|URL or JARL_SERVER. A command aimed at
  several servers is dry-run on all of them first and only runs if every
  one accepts it. Named servers always use their own token.
- Reverse zones: /32 and /128 get single-address zones; networks between
  octet or nibble boundaries (e.g. a /22) are covered by several zones
  created together, from the CLI and the web UI.
- Fix: under jarl.service's RestrictSUIDSGID, creating a view directory
  failed on chmod with the setgid bit; fall back to the permission bits.
- Web UI: the review/live switch is a small header button, and the
  pending-changes bar only shows when there are pending changes.
- TSIG key wording; the keys page points to restricted API tokens.
- Docs: several servers (cli.md), a secondary server (operations.md),
  tokens vs TSIG keys (permissions.md); CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/concepts.md

@@ -219,6 +219,8 @@ journal through jarld's log.
   zones. Use the API (for example `jarl acme`) instead of nsupdate.
 * **DNSSEC signing**: not managed yet. The zone directory is
   named-writable, so `dnssec-policy` can be added later.
-* **Several servers**: Jarl manages the named on its own host. Secondaries
-  elsewhere get zones by normal AXFR/IXFR (`allow-transfer`, `also-notify`,
-  TSIG keys).
+* **Several servers from one jarld**: each jarld manages the named on its
+  own host. A second server runs its own jarld with secondary zones, which
+  copy the primary's zones by normal AXFR/IXFR (see "A secondary server" in
+  [operations.md](operations.md)). The CLI can name both and run a command
+  on both at once ([cli.md](cli.md#several-servers-and-groups)).