feat(doctor): add fn doctor CLI + 14 functions for system management

Adds `fn doctor` read-only diagnostic command with subcommands artefacts,
services, sync, uses-functions, unused, and --json flag for agents.
Each subcommand wraps a registry function in functions/infra/.

New functions:
- artefact_doctor, services_status, pc_locations_drift,
  audit_uses_functions, find_unused_functions (Go diagnostics)
- backup_sqlite_db, rotate_backups, wait_for_http, wait_for_port,
  port_kill, tail_journal, pre_commit_hook_install (bash utilities)
- notify_telegram (Go HTTP)
- backup_all pipeline (tag launcher)

Plus prior session leftovers (scan_secrets_in_dirty, append_diary_entry,
git utilities, http_session_cookie_middleware, compile/full-git pipelines).

Fixes pc_locations_drift filepath.Join bug with absolute dir_path.
Documents fn doctor in CLAUDE.md, .claude/rules/fn_doctor.md (rule 23),
docs/architecture.md, CHANGELOG.md (2026-05-07), and diary entry.

First fn doctor uses-functions run found drift in 7/12 apps (deuda
para sincronizar app.md con imports reales).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bash/functions/infra/backup_sqlite_db.md

@@ -0,0 +1,55 @@
+---
+name: backup_sqlite_db
+kind: function
+lang: bash
+domain: infra
+version: "1.0.0"
+purity: impure
+signature: "backup_sqlite_db <source> <dest>"
+description: "Snapshot atomico de una BD SQLite usando VACUUM INTO. Mas seguro que cp: no corrompe si hay escrituras concurrentes. Crea el directorio destino si no existe. Si dest ya existe, lo sobrescribe."
+tags: [backup, sqlite, vacuum, snapshot, infra]
+uses_functions: []
+uses_types: []
+returns: []
+returns_optional: false
+error_type: "error_go_core"
+imports: []
+params:
+  - name: source
+    desc: "Ruta absoluta o relativa a la BD SQLite fuente. Debe existir y ser un archivo SQLite valido."
+  - name: dest
+    desc: "Ruta absoluta o relativa del snapshot destino. Se crea (o sobreescribe) con VACUUM INTO."
+output: "Imprime 'OK <bytes> bytes -> <dest>' a stdout en caso de exito. Los errores van a stderr."
+tested: false
+tests: []
+test_file_path: ""
+file_path: "bash/functions/infra/backup_sqlite_db.sh"
+---
+
+## Ejemplo
+
+```bash
+source bash/functions/infra/backup_sqlite_db.sh
+
+# Backup de registry.db en directorio backups/
+backup_sqlite_db registry.db backups/registry_$(date +%Y%m%d_%H%M%S).db
+# OK 2457600 bytes -> backups/registry_20260507_103045.db
+
+# Backup con rutas absolutas
+backup_sqlite_db /opt/apps/myapp/myapp.db /mnt/backups/myapp.db
+```
+
+## Exit codes
+
+| Codigo | Significado |
+|--------|-------------|
+| 0 | Exito |
+| 1 | Source no existe |
+| 2 | Source no es SQLite valido |
+| 3 | Fallo en VACUUM INTO o creacion de directorio |
+| 4 | Dest tiene tamaño 0 tras el backup |
+| 5 | sqlite3 CLI no encontrado en PATH |
+
+## Notas
+
+`VACUUM INTO` (disponible desde SQLite 3.27.0) ejecuta un vacuum completo y escribe la BD resultado en un nuevo archivo. Es atomico: si falla a mitad, el destino no queda en estado inconsistente. Esto lo hace superior a un `cp` simple cuando la BD puede estar recibiendo escrituras concurrentes (WAL mode, journal). El archivo resultante es siempre una BD limpia y compactada.