add doctor, scheduled backups and fetch; release 0.0.12

- doctor [<name>] [--fix]: checks the system (user, programs, folders,
  zips, units and leftover copies in /etc, sandbox access to moved
  folders, journal, polkit, daemon, orphaned boot links and schedules)
  and each instance (ownership, server zip, config paths, mods, ports,
  failed starts/backups), with a fix for each. --fix applies the safe
  ones and re-checks them.
- backup enable|disable|now|list: a systemd timer per instance
  (terraria-backup@.timer, Persistent=), saving the world first, into
  /var/lib/terraria/backups/<name>/ (group-readable), pruning only
  scheduled backups. rename carries the schedule, delete removes it.
  upgrade's backups move there too.
- fetch vanilla|tmodloader [<version>] [--list] [--upgrade <name>]:
  downloads from terraria.org / tModLoader's GitHub releases, checks
  GitHub's sha256 and the zip, names it with its version.
- terractld may write /etc/systemd/system, for backup enable and
  doctor --fix over --host.
- Units, tmpfiles, packaging, completion, docs and changelog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

systemd/terraria-backup@.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=Back up Terraria server (%i)
+Documentation=file://@DOCDIR@/README.md
+
+[Service]
+Type=oneshot
+# Saves the world first if the server is running, then archives the instance
+# (without server/) into /var/lib/terraria/backups/%i/ and removes the oldest
+# scheduled backups beyond the number to keep. Set up with:
+#   terractl backup enable %i [--every <when>] [--keep <number>]
+ExecStart=@BINDIR@/terractl backup now %i
+Nice=10
+IOSchedulingClass=idle
+
+# Runs as root, like 'sudo terractl backup now'
+NoNewPrivileges=true
+ProtectSystem=full
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true