feat(doctor): add fn doctor CLI + 14 functions for system management

Adds `fn doctor` read-only diagnostic command with subcommands artefacts,
services, sync, uses-functions, unused, and --json flag for agents.
Each subcommand wraps a registry function in functions/infra/.

New functions:
- artefact_doctor, services_status, pc_locations_drift,
  audit_uses_functions, find_unused_functions (Go diagnostics)
- backup_sqlite_db, rotate_backups, wait_for_http, wait_for_port,
  port_kill, tail_journal, pre_commit_hook_install (bash utilities)
- notify_telegram (Go HTTP)
- backup_all pipeline (tag launcher)

Plus prior session leftovers (scan_secrets_in_dirty, append_diary_entry,
git utilities, http_session_cookie_middleware, compile/full-git pipelines).

Fixes pc_locations_drift filepath.Join bug with absolute dir_path.
Documents fn doctor in CLAUDE.md, .claude/rules/fn_doctor.md (rule 23),
docs/architecture.md, CHANGELOG.md (2026-05-07), and diary entry.

First fn doctor uses-functions run found drift in 7/12 apps (deuda
para sincronizar app.md con imports reales).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bash/functions/pipelines/full_git_pull.md

@@ -0,0 +1,54 @@
+---
+name: full_git_pull
+kind: pipeline
+lang: bash
+domain: pipelines
+version: "1.0.0"
+purity: impure
+signature: "full_git_pull() -> stdout: tabla resumen"
+description: "Pull automatico de fn_registry + todos los sub-repos locales + submodules + fn sync. Descubre repos locales, stashea dirty trees antes de pullear, hace pull --ff-only, actualiza submodulos del repo principal, pulla ~/.password-store, regenera registry.db con fn index y ejecuta fn sync."
+tags: [git, pull, sync, registry, pipeline]
+uses_functions:
+  - discover_git_repos_bash_infra
+  - git_pull_with_stash_bash_infra
+  - pass_get_bash_infra
+uses_types: []
+returns: []
+returns_optional: false
+error_type: "error_go_core"
+imports: []
+params: []
+output: "tabla resumen por stdout: pull status de cada repo, estado de pass-secrets, submodulos actualizados, resultado de fn index, resultado de fn sync; lista de repos con divergencia o conflicto de stash al final"
+tested: false
+tests: []
+test_file_path: ""
+file_path: "bash/functions/pipelines/full_git_pull.sh"
+---
+
+## Ejemplo
+
+```bash
+# Pull completo
+fn run full_git_pull
+
+# Directo
+bash bash/functions/pipelines/full_git_pull.sh
+```
+
+## Flujo
+
+1. `discover_git_repos` — lista repos git locales bajo `$FN_REGISTRY_ROOT`
+2. `git_pull_with_stash` — para cada repo: stash si dirty, fetch, pull --ff-only, pop stash
+3. `git submodule update --init --recursive` — actualiza submodulos del repo principal
+4. `git_pull_with_stash` sobre `~/.password-store` (si existe)
+5. `CGO_ENABLED=1 ./fn index` — regenera registry.db
+6. `fn sync` — sincroniza proposals, apps, projects, analysis, vaults, pc_locations
+
+## Variables de entorno
+
+- `FN_REGISTRY_ROOT` — raiz del registry; default `/home/lucas/fn_registry`
+- `FN_REGISTRY_API`, `REGISTRY_API_TOKEN` — se cargan de `pass registry/*`
+
+## Notas
+
+Solo hace pull fast-forward — nunca rebase ni merge automatico. Los repos con divergencia o conflicto de stash se listan al final del resumen para intervencion manual, pero el pipeline no aborta por ellos. No clona repos faltantes: cada PC tiene el subset que le interesa (clonar manualmente si se necesita uno nuevo). Modo completamente no-interactivo.