feat(doctor): add fn doctor CLI + 14 functions for system management

Adds `fn doctor` read-only diagnostic command with subcommands artefacts,
services, sync, uses-functions, unused, and --json flag for agents.
Each subcommand wraps a registry function in functions/infra/.

New functions:
- artefact_doctor, services_status, pc_locations_drift,
  audit_uses_functions, find_unused_functions (Go diagnostics)
- backup_sqlite_db, rotate_backups, wait_for_http, wait_for_port,
  port_kill, tail_journal, pre_commit_hook_install (bash utilities)
- notify_telegram (Go HTTP)
- backup_all pipeline (tag launcher)

Plus prior session leftovers (scan_secrets_in_dirty, append_diary_entry,
git utilities, http_session_cookie_middleware, compile/full-git pipelines).

Fixes pc_locations_drift filepath.Join bug with absolute dir_path.
Documents fn doctor in CLAUDE.md, .claude/rules/fn_doctor.md (rule 23),
docs/architecture.md, CHANGELOG.md (2026-05-07), and diary entry.

First fn doctor uses-functions run found drift in 7/12 apps (deuda
para sincronizar app.md con imports reales).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bash/functions/pipelines/backup_all.md

@@ -0,0 +1,73 @@
+---
+name: backup_all
+kind: pipeline
+lang: bash
+domain: pipelines
+version: "1.0.0"
+purity: impure
+signature: "backup_all(backup_root: string) -> void"
+description: "Backup completo del estado del registry: snapshot atomico de registry.db, snapshot de cada operations.db de cada app, y rsync de todos los vaults declarados en vault.yaml. Aplica retention 7/4/12 (daily/weekly/monthly) con rotate_backups. Idempotente, llamable a diario desde cron o systemd-timer."
+tags: ["backup", "launcher", "pipeline", "retention"]
+uses_functions:
+  - backup_sqlite_db_bash_infra
+  - rotate_backups_bash_infra
+uses_types: []
+returns: []
+returns_optional: false
+error_type: "error_go_core"
+imports: []
+params:
+  - name: backup_root
+    desc: "Directorio raiz donde se guardan todos los backups (ej. ~/backups/fn_registry). Se crea si no existe."
+output: "Linea de resumen a stdout: ISO_timestamp, bytes de registry.db, conteo de ops backupeadas, conteo de vaults sincronizados, errores parciales y segundos transcurridos. Misma linea se hace append en backup_root/backup_log.txt."
+tested: false
+tests: []
+test_file_path: ""
+file_path: "bash/functions/pipelines/backup_all.sh"
+---
+
+## Ejemplo
+
+```bash
+# Backup manual a ~/backups/fn_registry
+export FN_REGISTRY_ROOT=/home/lucas/fn_registry
+backup_all ~/backups/fn_registry
+
+# Salida esperada:
+# 2026-05-07T10:30:00+02:00 registry=4194304B ops=3 vaults=2 partial_errors=0 elapsed=12s
+
+# Entrada en crontab (diario a las 02:00)
+# 0 2 * * * FN_REGISTRY_ROOT=/home/lucas/fn_registry bash /home/lucas/fn_registry/bash/functions/pipelines/backup_all.sh ~/backups/fn_registry
+```
+
+## Estructura de backup_root/
+
+```
+registry/
+  daily.0  daily.1 ... daily.6
+  weekly.0 ... weekly.3
+  monthly.0 ... monthly.11
+operations/
+  <app_name>/
+    daily.0 ... (misma retencion)
+vaults/
+  <vault_name>/
+    daily.0/  (directorio rsync con hard-links)
+    daily.1/  ...
+backup_log.txt
+```
+
+## Codigos de salida
+
+| Codigo | Significado |
+|--------|-------------|
+| 0 | Exito completo |
+| 1 | FN_REGISTRY_ROOT no localizable |
+| 2 | backup_root no se puede crear/escribir |
+| 3 | Fallo critico en backup de registry.db |
+| 4 | Errores parciales en ops o vaults (no critico, continua) |
+| 5 | Herramientas del sistema faltantes (sqlite3, rsync, find) |
+
+## Notas
+
+Idempotente: llamar multiples veces el mismo dia solo rota si hay cambios de fecha. Los vaults deducan bloques iguales con rsync --link-dest, por lo que el primer run ocupa el espacio real y los sucesivos solo almacenan los deltas. Operations.db de apps sin dicho archivo se ignoran silenciosamente. Requiere FN_REGISTRY_ROOT seteado o ejecutar desde la raiz del registry.