Multi-server CLI, more reverse zones, and a fix for new view directories

- CLI: name several servers and groups in the config file; select them
  with -s/--server NAME|GROUP|all|URL or JARL_SERVER. A command aimed at
  several servers is dry-run on all of them first and only runs if every
  one accepts it. Named servers always use their own token.
- Reverse zones: /32 and /128 get single-address zones; networks between
  octet or nibble boundaries (e.g. a /22) are covered by several zones
  created together, from the CLI and the web UI.
- Fix: under jarl.service's RestrictSUIDSGID, creating a view directory
  failed on chmod with the setgid bit; fall back to the permission bits.
- Web UI: the review/live switch is a small header button, and the
  pending-changes bar only shows when there are pending changes.
- TSIG key wording; the keys page points to restricted API tokens.
- Docs: several servers (cli.md), a secondary server (operations.md),
  tokens vs TSIG keys (permissions.md); CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/zones.js

@@ -1,5 +1,5 @@
 import { h, mount, table, modal, field, input, select, textarea, lines, toast, errorBox, display, badge } from "../ui.js";
-import { get, change, describeResult, can, draftQuery } from "../api.js";
+import { get, change, changeMany, describeResult, can, draftQuery } from "../api.js";
 import { rerender } from "../app.js";
 import { checkDomain, reverseZoneFor } from "../names.js";
 
@@ -63,11 +63,13 @@ export async function newZoneDialog(views, zones, settings) {
   const cloneSel = select([["", "– don't copy –"]], "");
   const comment = input();
   const updateClones = () => {
-    const n = (kind === "reverse" ? reverseZoneFor(name.value).name || "" : name.value.trim().toLowerCase().replace(/\.$/, "")) + ".";
+    // Records can only be copied into a single zone.
+    const n = (kind === "reverse" ? reverseZoneFor(name.value).name || "-" : name.value.trim().toLowerCase().replace(/\.$/, "")) + ".";
     mount(cloneSel, h("option", { value: "" }, "– don't copy –"),
       zones.filter((z) => z.type === "primary" && z.name === n).map((z) => h("option", { value: z.id }, z.display_name + " [" + (z.view || "no view") + "]")));
   };
-  // check validates the name as typed and returns the zone name (or null).
+  // check validates the name as typed and returns the zone name (or null);
+  // a network that needs several reverse zones gives a list of names.
   const check = () => {
     const v = name.value.trim();
     const msgs = [];
@@ -80,8 +82,16 @@ export async function newZoneDialog(views, zones, settings) {
     if (kind === "reverse") {
       const r = reverseZoneFor(v);
       if (r.error) msgs.push(["err", r.error]);
-      else zoneName = r.name;
-      mount(preview, zoneName ? h("div", null, "Zone name: ", h("strong", { class: "mono" }, zoneName), h("span", { class: "muted" }, " · answers \"which host has address …?\" for " + r.network)) : null,
+      else zoneName = r.name || r.names;
+      const single = /\/(32|128)$/.test(r.network || "");
+      const what = single ? " · answers \"which host has address " + r.network.replace(/\/\d+$/, "") + "?\" and nothing else in its network"
+        : " · answers \"which host has address …?\" for " + r.network;
+      mount(preview,
+        typeof zoneName === "string" ? h("div", null, "Zone name: ", h("strong", { class: "mono" }, zoneName), h("span", { class: "muted" }, what)) : null,
+        Array.isArray(zoneName) ? h("div", null,
+          h("div", null, "Reverse names follow the dots, so " + r.network + " is covered by " + zoneName.length + " zones, created together:"),
+          h("div", { class: "mono small" }, zoneName.join(", ")),
+          h("div", { class: "muted small" }, "Answers \"which host has address …?\" for " + r.network + ".")) : null,
         msgs.map(([k, m]) => h("div", { class: "msg " + k + " small" }, m)));
     } else {
       const c = checkDomain(v);
@@ -104,9 +114,9 @@ export async function newZoneDialog(views, zones, settings) {
         msgs.map(([k, m]) => h("div", { class: "msg " + k + " small" }, m)));
     }
     if (zoneName && kind === "reverse") {
-      const fq = zoneName + ".";
-      if (zones.find((z) => z.name === fq && (z.view || "") === (view.value || ""))) {
-        mount(preview, h("div", { class: "msg err small" }, "the reverse zone " + zoneName + " already exists" + (view.value ? " in view " + view.value : "")));
+      const existing = [zoneName].flat().filter((n) => zones.find((z) => z.name === n + "." && (z.view || "") === (view.value || "")));
+      if (existing.length) {
+        mount(preview, h("div", { class: "msg err small" }, "the reverse zone" + (existing.length > 1 ? "s " : " ") + existing.join(", ") + (existing.length > 1 ? " already exist" : " already exists") + (view.value ? " in view " + view.value : "")));
         return null;
       }
     }
@@ -194,7 +204,9 @@ export async function newZoneDialog(views, zones, settings) {
       }
       if (opts.length) data.options = opts;
       try {
-        const r = await change("POST", "/zones", data);
+        const r = Array.isArray(zoneName)
+          ? await changeMany(zoneName.map((n) => ({ op: "zone.create", data: { ...data, name: n } })), "reverse zones for " + name.value.trim())
+          : await change("POST", "/zones", data);
         toast(describeResult(r));
         rerender();
         return true;