feat(doctor): add fn doctor CLI + 14 functions for system management

Adds `fn doctor` read-only diagnostic command with subcommands artefacts,
services, sync, uses-functions, unused, and --json flag for agents.
Each subcommand wraps a registry function in functions/infra/.

New functions:
- artefact_doctor, services_status, pc_locations_drift,
  audit_uses_functions, find_unused_functions (Go diagnostics)
- backup_sqlite_db, rotate_backups, wait_for_http, wait_for_port,
  port_kill, tail_journal, pre_commit_hook_install (bash utilities)
- notify_telegram (Go HTTP)
- backup_all pipeline (tag launcher)

Plus prior session leftovers (scan_secrets_in_dirty, append_diary_entry,
git utilities, http_session_cookie_middleware, compile/full-git pipelines).

Fixes pc_locations_drift filepath.Join bug with absolute dir_path.
Documents fn doctor in CLAUDE.md, .claude/rules/fn_doctor.md (rule 23),
docs/architecture.md, CHANGELOG.md (2026-05-07), and diary entry.

First fn doctor uses-functions run found drift in 7/12 apps (deuda
para sincronizar app.md con imports reales).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bash/functions/pipelines/full_git_push.md

@@ -0,0 +1,64 @@
+---
+name: full_git_push
+kind: pipeline
+lang: bash
+domain: pipelines
+version: "1.0.0"
+purity: impure
+signature: "full_git_push(commit_message?: string) -> stdout: tabla resumen"
+description: "Push automatico de fn_registry + todos los sub-repos + fn sync. Descubre repos, escanea secrets (aborta si detecta), auto-inicializa apps/analyses sin .git via ensure_repo_synced, auto-commitea dirty trees, pushea solo repos adelantados, pushea ~/.password-store sin commitear, y ejecuta fn sync."
+tags: [git, push, sync, registry, pipeline]
+uses_functions:
+  - discover_git_repos_bash_infra
+  - scan_secrets_in_dirty_bash_cybersecurity
+  - git_auto_commit_dirty_bash_infra
+  - git_push_if_ahead_bash_infra
+  - ensure_repo_synced_bash_infra
+  - pass_get_bash_infra
+uses_types: []
+returns: []
+returns_optional: false
+error_type: "error_go_core"
+imports: []
+params:
+  - name: commit_message
+    desc: "mensaje de commit fijo para todos los repos (opcional); si se omite, cada repo recibe un mensaje generado automaticamente segun sus cambios"
+output: "tabla resumen por stdout: commits creados por repo, push status de cada repo, estado de pass-secrets, resultado de fn sync"
+tested: false
+tests: []
+test_file_path: ""
+file_path: "bash/functions/pipelines/full_git_push.sh"
+---
+
+## Ejemplo
+
+```bash
+# Push con mensaje automatico
+fn run full_git_push
+
+# Push con mensaje fijo para todos los repos
+fn run full_git_push "chore: sync desde home-wsl"
+
+# Directo
+bash bash/functions/pipelines/full_git_push.sh "feat: nueva funcion"
+```
+
+## Flujo
+
+1. `discover_git_repos` — lista todos los repos bajo `$FN_REGISTRY_ROOT`
+2. Auto-init — para cada app/analysis sin `.git`, llama `ensure_repo_synced` (requiere `GITEA_URL`/`GITEA_TOKEN` via `pass_get`)
+3. `scan_secrets_in_dirty` — escanea cada repo; si hay matches **aborta todo** y lista los archivos
+4. `git_auto_commit_dirty` — commitea dirty trees con mensaje fijo o generado
+5. `git_push_if_ahead` — pushea solo repos con commits locales (sin tocar la red para los up-to-date)
+6. Push de `~/.password-store` — solo push (sin commit; pass se autocommitea)
+7. `fn sync` — sincroniza proposals, apps, projects, analysis, vaults, pc_locations con registry_api
+
+## Variables de entorno
+
+- `FN_REGISTRY_ROOT` — raiz del registry; default `/home/lucas/fn_registry`
+- `GITEA_URL`, `GITEA_TOKEN` — se cargan de `pass agentes/gitea-url` y `pass gitea/dataforge-git-token`
+- `FN_REGISTRY_API`, `REGISTRY_API_TOKEN` — se cargan de `pass registry/*`
+
+## Notas
+
+El unico motivo para abortar antes de commitear es la deteccion de secrets. Cualquier otro error (push rechazado por non-fast-forward, fn sync no disponible) se reporta en el resumen y el pipeline continua con el resto de repos. Modo completamente no-interactivo.