feat(doctor): add fn doctor CLI + 14 functions for system management

Adds `fn doctor` read-only diagnostic command with subcommands artefacts,
services, sync, uses-functions, unused, and --json flag for agents.
Each subcommand wraps a registry function in functions/infra/.

New functions:
- artefact_doctor, services_status, pc_locations_drift,
  audit_uses_functions, find_unused_functions (Go diagnostics)
- backup_sqlite_db, rotate_backups, wait_for_http, wait_for_port,
  port_kill, tail_journal, pre_commit_hook_install (bash utilities)
- notify_telegram (Go HTTP)
- backup_all pipeline (tag launcher)

Plus prior session leftovers (scan_secrets_in_dirty, append_diary_entry,
git utilities, http_session_cookie_middleware, compile/full-git pipelines).

Fixes pc_locations_drift filepath.Join bug with absolute dir_path.
Documents fn doctor in CLAUDE.md, .claude/rules/fn_doctor.md (rule 23),
docs/architecture.md, CHANGELOG.md (2026-05-07), and diary entry.

First fn doctor uses-functions run found drift in 7/12 apps (deuda
para sincronizar app.md con imports reales).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bash/functions/infra/tail_journal.md

@@ -0,0 +1,60 @@
+---
+name: tail_journal
+kind: function
+lang: bash
+domain: infra
+version: "1.0.0"
+purity: impure
+signature: "tail_journal(unit: string, lines: int=100, follow: bool=false, since: string=\"\", priority: string=\"info\") -> void"
+description: "Wrapper sobre journalctl con formato consistente. Tail logs de una unidad systemd con coloreado, filtro por prioridad y seguimiento opcional."
+tags: ["journal", "systemd", "logs"]
+uses_functions: []
+uses_types: []
+returns: []
+returns_optional: false
+error_type: "error_go_core"
+imports: []
+params:
+  - name: unit
+    desc: "Nombre de la unidad systemd (ej. registry-api.service, caddy). Acepta sin extension .service."
+  - name: lines
+    desc: "Numero de lineas iniciales a mostrar. Default 100."
+  - name: follow
+    desc: "Si true o -f, activa seguimiento continuo (journalctl -f). Default false."
+  - name: since
+    desc: "Filtro temporal: '1 hour ago', 'yesterday', '2026-05-07'. Default vacio (sin filtro)."
+  - name: priority
+    desc: "Prioridad minima de logs: emerg|alert|crit|err|warning|notice|info|debug. Default info."
+output: "Lineas de journalctl en formato short-iso, una por linea. Si follow=true, flujo continuo."
+example: "tail_journal registry-api 200 true"
+tested: false
+tests: []
+test_file_path: ""
+file_path: "bash/functions/infra/tail_journal.sh"
+---
+
+## Ejemplo
+
+```bash
+# Ver ultimas 100 lineas de un servicio
+tail_journal caddy
+
+# Seguimiento continuo con 50 lineas iniciales
+tail_journal registry-api.service 50 true
+
+# Solo errores de la ultima hora
+tail_journal my-app 200 false "1 hour ago" err
+
+# Con pipe (funciona sin bufferizado)
+tail_journal registry-api 100 true "" warning | grep "ERROR"
+```
+
+## Notas
+
+Detecta automaticamente si la unit pertenece al usuario (systemctl --user) o al sistema (sudo journalctl). Si la unit no es de usuario, se llama con sudo — el usuario debe tener NOPASSWD para journalctl o sudo configurado.
+
+Si follow=true, usa `stdbuf -oL` para deshabilitar el bufferizado de stdout, lo que permite piping en tiempo real (ej. `tail_journal ... | grep pattern`).
+
+Exit codes: 1 unit no existe o no especificada, 2 prioridad invalida, 5 journalctl no disponible.
+```
+---