Multi-server CLI, more reverse zones, and a fix for new view directories

- CLI: name several servers and groups in the config file; select them
  with -s/--server NAME|GROUP|all|URL or JARL_SERVER. A command aimed at
  several servers is dry-run on all of them first and only runs if every
  one accepts it. Named servers always use their own token.
- Reverse zones: /32 and /128 get single-address zones; networks between
  octet or nibble boundaries (e.g. a /22) are covered by several zones
  created together, from the CLI and the web UI.
- Fix: under jarl.service's RestrictSUIDSGID, creating a view directory
  failed on chmod with the setgid bit; fall back to the permission bits.
- Web UI: the review/live switch is a small header button, and the
  pending-changes bar only shows when there are pending changes.
- TSIG key wording; the keys page points to restricted API tokens.
- Docs: several servers (cli.md), a secondary server (operations.md),
  tokens vs TSIG keys (permissions.md); CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/deploy_test.go

@@ -0,0 +1,47 @@
+package engine
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+// Under systemd's RestrictSUIDSGID a chmod that sets the setgid bit fails
+// with EPERM; EnsureDir must still create a group-writable directory.
+func TestEnsureDirSetgidRestricted(t *testing.T) {
+	old := chmod
+	defer func() { chmod = old }()
+	chmod = func(name string, mode fs.FileMode) error {
+		if mode&fs.ModeSetgid != 0 {
+			return &fs.PathError{Op: "chmod", Path: name, Err: syscall.EPERM}
+		}
+		return os.Chmod(name, mode)
+	}
+	oldMask := syscall.Umask(0o027)
+	defer syscall.Umask(oldMask)
+
+	root := t.TempDir()
+	d := &Deployer{NamedWritable: []string{root}}
+	dir := filepath.Join(root, "internal")
+	if err := d.EnsureDir(dir, d.dirMode(dir)); err != nil {
+		t.Fatal(err)
+	}
+	fi, err := os.Stat(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if fi.Mode().Perm() != 0o770 {
+		t.Errorf("mode = %v, want group-writable 0770", fi.Mode())
+	}
+	// Unrestricted, the setgid bit is set too.
+	chmod = os.Chmod
+	dir2 := filepath.Join(root, "external")
+	if err := d.EnsureDir(dir2, d.dirMode(dir2)); err != nil {
+		t.Fatal(err)
+	}
+	if fi, _ := os.Stat(dir2); fi.Mode()&(fs.ModePerm|fs.ModeSetgid) != 0o770|fs.ModeSetgid {
+		t.Errorf("mode = %v, want 2770", fi.Mode())
+	}
+}