Multi-server CLI, more reverse zones, and a fix for new view directories

- CLI: name several servers and groups in the config file; select them
  with -s/--server NAME|GROUP|all|URL or JARL_SERVER. A command aimed at
  several servers is dry-run on all of them first and only runs if every
  one accepts it. Named servers always use their own token.
- Reverse zones: /32 and /128 get single-address zones; networks between
  octet or nibble boundaries (e.g. a /22) are covered by several zones
  created together, from the CLI and the web UI.
- Fix: under jarl.service's RestrictSUIDSGID, creating a view directory
  failed on chmod with the setgid bit; fall back to the permission bits.
- Web UI: the review/live switch is a small header button, and the
  pending-changes bar only shows when there are pending changes.
- TSIG key wording; the keys page points to restricted API tokens.
- Docs: several servers (cli.md), a secondary server (operations.md),
  tokens vs TSIG keys (permissions.md); CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dnsname/dnsname_test.go

@@ -2,6 +2,7 @@ package dnsname
 
 import (
 	"net/netip"
+	"strings"
 	"testing"
 )
 
@@ -185,3 +186,34 @@ func TestOwnerAddressInReverseZone(t *testing.T) {
 		}
 	}
 }
+
+func TestReverseZones(t *testing.T) {
+	cases := []struct {
+		prefix string
+		want   string // zones joined by spaces, or "error"
+	}{
+		{"10.0.10.0/24", "10.0.10.in-addr.arpa."},
+		{"10.0.10.100/32", "100.10.0.10.in-addr.arpa."},
+		{"10.0.8.0/22", "8.0.10.in-addr.arpa. 9.0.10.in-addr.arpa. 10.0.10.in-addr.arpa. 11.0.10.in-addr.arpa."},
+		{"10.0.9.0/22", "8.0.10.in-addr.arpa. 9.0.10.in-addr.arpa. 10.0.10.in-addr.arpa. 11.0.10.in-addr.arpa."},
+		{"172.16.0.0/12", "16.172.in-addr.arpa. 17.172.in-addr.arpa. 18.172.in-addr.arpa. 19.172.in-addr.arpa. 20.172.in-addr.arpa. 21.172.in-addr.arpa. 22.172.in-addr.arpa. 23.172.in-addr.arpa. 24.172.in-addr.arpa. 25.172.in-addr.arpa. 26.172.in-addr.arpa. 27.172.in-addr.arpa. 28.172.in-addr.arpa. 29.172.in-addr.arpa. 30.172.in-addr.arpa. 31.172.in-addr.arpa."},
+		{"10.0.0.0/17", "error"}, // 128 zones
+		{"10.0.10.64/26", "error"},
+		{"10.0.0.0/7", "error"},
+		{"2001:db8::/47", "0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. 1.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa."},
+		{"2001:db8::1/128", "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa."},
+	}
+	for _, c := range cases {
+		zones, err := ReverseZones(netip.MustParsePrefix(c.prefix))
+		got := strings.Join(zones, " ")
+		if err != nil {
+			got = "error"
+		}
+		if got != c.want {
+			t.Errorf("ReverseZones(%s) = %s (%v), want %s", c.prefix, got, err, c.want)
+		}
+	}
+	if _, err := ReverseZone(netip.MustParsePrefix("10.0.8.0/22")); err == nil || !strings.Contains(err.Error(), "spans 4 reverse zones") {
+		t.Errorf("ReverseZone /22: %v", err)
+	}
+}