feat(doctor): add fn doctor CLI + 14 functions for system management

Adds `fn doctor` read-only diagnostic command with subcommands artefacts,
services, sync, uses-functions, unused, and --json flag for agents.
Each subcommand wraps a registry function in functions/infra/.

New functions:
- artefact_doctor, services_status, pc_locations_drift,
  audit_uses_functions, find_unused_functions (Go diagnostics)
- backup_sqlite_db, rotate_backups, wait_for_http, wait_for_port,
  port_kill, tail_journal, pre_commit_hook_install (bash utilities)
- notify_telegram (Go HTTP)
- backup_all pipeline (tag launcher)

Plus prior session leftovers (scan_secrets_in_dirty, append_diary_entry,
git utilities, http_session_cookie_middleware, compile/full-git pipelines).

Fixes pc_locations_drift filepath.Join bug with absolute dir_path.
Documents fn doctor in CLAUDE.md, .claude/rules/fn_doctor.md (rule 23),
docs/architecture.md, CHANGELOG.md (2026-05-07), and diary entry.

First fn doctor uses-functions run found drift in 7/12 apps (deuda
para sincronizar app.md con imports reales).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bash/functions/infra/tbd_branch_finish.md

@@ -0,0 +1,52 @@
+---
+name: tbd_branch_finish
+kind: function
+lang: bash
+domain: infra
+version: "1.0.0"
+purity: impure
+signature: "tbd_branch_finish([merge_title: string]) -> void"
+description: "Integra una rama TBD (issue/* o quick/*) a master/main con merge --no-ff, publica el merge al remote y elimina la rama local. Autodetecta la rama base (master/main), verifica working tree limpio y construye el titulo del merge commit. NO ejecuta tests — esa responsabilidad es del caller. Exit 2 si hay conflicto de merge (deja al usuario resolver)."
+tags: [git, tbd, merge, trunk-based-development, workflow]
+uses_functions: []
+uses_types: []
+returns: []
+returns_optional: false
+error_type: "error_go_core"
+imports: []
+params:
+  - name: merge_title
+    desc: "Titulo opcional del merge commit. Si se provee, el commit sera 'merge: <rama> — <merge_title>'. Si no, sera 'merge: <rama>'."
+output: "Mergea la rama a base, hace push y elimina la rama local. Imprime confirmacion a stdout. Exit 1 en error (dirty tree, push fallido, no en rama TBD). Exit 2 si hay conflicto de merge (merge iniciado pero no resuelto — el usuario debe resolver manualmente)."
+tested: true
+tests:
+  - "finish lands on base branch"
+  - "issue branch deleted locally"
+  - "finish exits 0"
+  - "merge commit pushed to remote"
+  - "quick branch finish lands on master"
+  - "merge title included in commit"
+  - "dirty tree exits 1"
+  - "on master exits 1"
+  - "non-TBD branch exits 1"
+  - "works with main as base"
+test_file_path: "bash/functions/infra/tbd_branch_finish.sh"
+file_path: "bash/functions/infra/tbd_branch_finish.sh"
+---
+
+## Ejemplo
+
+```bash
+# Desde una rama issue/0042-add-auth, sin titulo adicional
+tbd_branch_finish
+
+# Con titulo descriptivo en el merge commit
+tbd_branch_finish "implementar autenticacion OAuth"
+
+# Ejecutar suite de tests
+bash bash/functions/infra/tbd_branch_finish.sh --test
+```
+
+## Notas
+
+La funcion NO ejecuta tests del proyecto — esa responsabilidad es del caller (slash command, agente, CI) porque depende del stack (go test, pytest, ctest, etc.). Si el push falla, la rama local NO se elimina para no perder trabajo. Si hay conflicto de merge, sale con exit 2 dejando el repo en estado de merge-en-progreso para que el usuario resuelva con `git add` + `git commit`. Los tests internos usan un remote bare simulado con `git init --bare` para validar el push completo.