feat(doctor): add fn doctor CLI + 14 functions for system management

Adds `fn doctor` read-only diagnostic command with subcommands artefacts,
services, sync, uses-functions, unused, and --json flag for agents.
Each subcommand wraps a registry function in functions/infra/.

New functions:
- artefact_doctor, services_status, pc_locations_drift,
  audit_uses_functions, find_unused_functions (Go diagnostics)
- backup_sqlite_db, rotate_backups, wait_for_http, wait_for_port,
  port_kill, tail_journal, pre_commit_hook_install (bash utilities)
- notify_telegram (Go HTTP)
- backup_all pipeline (tag launcher)

Plus prior session leftovers (scan_secrets_in_dirty, append_diary_entry,
git utilities, http_session_cookie_middleware, compile/full-git pipelines).

Fixes pc_locations_drift filepath.Join bug with absolute dir_path.
Documents fn doctor in CLAUDE.md, .claude/rules/fn_doctor.md (rule 23),
docs/architecture.md, CHANGELOG.md (2026-05-07), and diary entry.

First fn doctor uses-functions run found drift in 7/12 apps (deuda
para sincronizar app.md con imports reales).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bash/functions/infra/git_pull_with_stash.md

@@ -0,0 +1,68 @@
+---
+name: git_pull_with_stash
+kind: function
+lang: bash
+domain: infra
+version: "1.0.0"
+purity: impure
+signature: "git_pull_with_stash(repo_dir: string) -> stdout: status"
+description: "Si el repo tiene cambios pendientes, los stashea antes de pullear. Hace fetch origin + pull --ff-only. Si hay divergencia reporta [diverged] y restaura el stash. Si stash pop da conflicto reporta [stash-conflict] sin tocarlo. Exit 0 siempre para que el caller pueda continuar con otros repos."
+tags: [git, pull, stash, infra, sync]
+uses_functions: []
+uses_types: []
+returns: []
+returns_optional: false
+error_type: "error_go_core"
+imports: []
+params:
+  - name: repo_dir
+    desc: "path al repo git donde pullear; default '.'"
+output: "linea de estado por stdout: '[pulled] repo', '[up-to-date] repo', '[diverged] repo' o '[stash-conflict] repo'"
+tested: false
+tests: []
+test_file_path: ""
+file_path: "bash/functions/infra/git_pull_with_stash.sh"
+---
+
+## Ejemplo
+
+```bash
+source bash/functions/infra/git_pull_with_stash.sh
+
+# Pullear repo con auto-stash
+status=$(git_pull_with_stash /home/lucas/fn_registry)
+echo "$status"
+# [pulled] fn_registry
+# o:
+# [up-to-date] fn_registry
+# o:
+# [diverged] fn_registry  (pull fallo por divergencia)
+
+# Iterar y coleccionar divergencias
+diverged=()
+while IFS= read -r repo; do
+    result=$(git_pull_with_stash "$repo")
+    echo "$result"
+    if [[ "$result" == "[diverged]"* || "$result" == "[stash-conflict]"* ]]; then
+        diverged+=("$result")
+    fi
+done < <(discover_git_repos /home/lucas/fn_registry)
+
+if [[ ${#diverged[@]} -gt 0 ]]; then
+    echo "ATENCION: repos que requieren intervencion manual:"
+    printf '  %s\n' "${diverged[@]}"
+fi
+```
+
+## Estados de salida
+
+| Linea stdout | Significado |
+|---|---|
+| `[pulled] repo` | Se trajo commits nuevos correctamente |
+| `[up-to-date] repo` | Ya estaba al dia (o sin remote) |
+| `[diverged] repo` | Pull --ff-only fallo — requiere rebase/merge manual |
+| `[stash-conflict] repo` | Pull ok pero stash pop tuvo conflictos — requiere resolucion manual |
+
+## Notas
+
+Solo hace pull fast-forward — nunca rebase ni merge automatico. El stash incluye untracked (`--include-untracked`) para no perder archivos nuevos no trackeados. Exit 1 solo si `repo_dir` no es un repo git. Todos los demas casos (divergencia, conflictos, sin remote) retornan exit 0 con linea descriptiva.