feat(doctor): add fn doctor CLI + 14 functions for system management

Adds `fn doctor` read-only diagnostic command with subcommands artefacts,
services, sync, uses-functions, unused, and --json flag for agents.
Each subcommand wraps a registry function in functions/infra/.

New functions:
- artefact_doctor, services_status, pc_locations_drift,
  audit_uses_functions, find_unused_functions (Go diagnostics)
- backup_sqlite_db, rotate_backups, wait_for_http, wait_for_port,
  port_kill, tail_journal, pre_commit_hook_install (bash utilities)
- notify_telegram (Go HTTP)
- backup_all pipeline (tag launcher)

Plus prior session leftovers (scan_secrets_in_dirty, append_diary_entry,
git utilities, http_session_cookie_middleware, compile/full-git pipelines).

Fixes pc_locations_drift filepath.Join bug with absolute dir_path.
Documents fn doctor in CLAUDE.md, .claude/rules/fn_doctor.md (rule 23),
docs/architecture.md, CHANGELOG.md (2026-05-07), and diary entry.

First fn doctor uses-functions run found drift in 7/12 apps (deuda
para sincronizar app.md con imports reales).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/CLAUDE.md

@@ -145,6 +145,16 @@ fn show <id>
 fn add -k function                  # Template
 fn check params                     # Lista funciones sin params_schema
 
+# Doctor: diagnostico read-only del registry y artefactos
+fn doctor                           # Corre todos los checks
+fn doctor artefacts                 # git/venv/app.md/upstream de cada app y analysis
+fn doctor services                  # apps tag 'service' + systemctl + puerto
+fn doctor sync                      # drift pc_locations BD vs disco
+fn doctor uses-functions            # imports reales vs uses_functions del app.md
+fn doctor unused                    # funciones del registry sin consumidores
+fn doctor --json                    # salida JSON (cualquier subcomando)
+# Ver .claude/rules/fn_doctor.md para mapeo subcomando → funcion + acciones derivadas.
+
 # Ejecutar funciones y pipelines (fn run)
 fn run <id_or_name> [args...]       # Ejecuta por ID o nombre
 fn run init_metabase --project test # Go pipeline (go run .)