Multi-server CLI, more reverse zones, and a fix for new view directories

- CLI: name several servers and groups in the config file; select them
  with -s/--server NAME|GROUP|all|URL or JARL_SERVER. A command aimed at
  several servers is dry-run on all of them first and only runs if every
  one accepts it. Named servers always use their own token.
- Reverse zones: /32 and /128 get single-address zones; networks between
  octet or nibble boundaries (e.g. a /22) are covered by several zones
  created together, from the CLI and the web UI.
- Fix: under jarl.service's RestrictSUIDSGID, creating a view directory
  failed on chmod with the setgid bit; fall back to the permission bits.
- Web UI: the review/live switch is a small header button, and the
  pending-changes bar only shows when there are pending changes.
- TSIG key wording; the keys page points to restricted API tokens.
- Docs: several servers (cli.md), a secondary server (operations.md),
  tokens vs TSIG keys (permissions.md); CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/operations.md

@@ -105,6 +105,36 @@ Start named, then apply again.
 | Lost every admin account | `sudo -u jarl jarld user add --admin rescue` |
 | Need a token without the web UI | `sudo -u jarl jarld user token admin cli` |
 
+## A secondary server
+
+A second name server runs its own named and jarld; its zones are of type
+`secondary` and copy the primary's records by zone transfer, so you only
+ever edit records on the primary. With both named in the CLI configuration
+([cli.md](cli.md#several-servers-and-groups)):
+
+```sh
+# 1. One TSIG key with the same secret on both servers.
+jarl -s ns1 tsig create xfer                     # prints the secret
+jarl -s ns2 tsig create xfer --secret 'THE-SECRET'
+
+# 2. On the primary: let the key transfer the zone, and list ns2 as a
+#    name server (named sends NOTIFY to the zone's NS records).
+jarl -s ns1 option set allow-transfer '{ key xfer; }' --zone adbraun.lol
+jarl -s ns1 record add adbraun.lol @ NS ns2.adbraun.lol.
+
+# 3. On the secondary: the zone, copied from the primary with the key.
+jarl -s ns2 zone create adbraun.lol --type secondary --primary "192.0.2.53 key xfer"
+```
+
+If ns2 isn't one of the zone's NS records, add `also-notify { ADDRESS; };`
+on the primary so it learns about changes quickly. With views, each view's
+zones are transferred separately; match the secondary's requests to the
+right view, for example with `match-clients { key xfer; ... };`.
+
+Things that both servers need, such as ACLs, can be changed on both at once
+with a group (`jarl -s dns acl update ...`): the change is checked on both
+first and applied only if both accept it.
+
 ## Taking Jarl out of the picture
 
 The generated files are plain BIND configuration. To stop using Jarl,