feat(doctor): add fn doctor CLI + 14 functions for system management

Adds `fn doctor` read-only diagnostic command with subcommands artefacts,
services, sync, uses-functions, unused, and --json flag for agents.
Each subcommand wraps a registry function in functions/infra/.

New functions:
- artefact_doctor, services_status, pc_locations_drift,
  audit_uses_functions, find_unused_functions (Go diagnostics)
- backup_sqlite_db, rotate_backups, wait_for_http, wait_for_port,
  port_kill, tail_journal, pre_commit_hook_install (bash utilities)
- notify_telegram (Go HTTP)
- backup_all pipeline (tag launcher)

Plus prior session leftovers (scan_secrets_in_dirty, append_diary_entry,
git utilities, http_session_cookie_middleware, compile/full-git pipelines).

Fixes pc_locations_drift filepath.Join bug with absolute dir_path.
Documents fn doctor in CLAUDE.md, .claude/rules/fn_doctor.md (rule 23),
docs/architecture.md, CHANGELOG.md (2026-05-07), and diary entry.

First fn doctor uses-functions run found drift in 7/12 apps (deuda
para sincronizar app.md con imports reales).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

functions/infra/artefact_doctor.md

@@ -0,0 +1,61 @@
+---
+name: artefact_doctor
+kind: function
+lang: go
+domain: infra
+version: "1.0.0"
+purity: impure
+signature: "func ArtefactDoctor(registryRoot string) ([]ArtefactCheck, error)"
+description: "Audita la salud de cada artefacto (apps + analyses) registrado en registry.db. Para cada uno verifica: directorio en disco, presencia de .git, manifest parseable (app.md/analysis.md con campo name), venv de Python valido (solo analyses) y rama upstream configurada en git. Read-only, no toca red ni modifica nada."
+tags: [doctor, health, artefact, audit]
+uses_functions: []
+uses_types: []
+returns: []
+returns_optional: false
+error_type: "error_go_core"
+imports: ["bufio", "bytes", "context", "database/sql", "fmt", "os", "os/exec", "path/filepath", "strings", "time", "github.com/mattn/go-sqlite3"]
+params:
+  - name: registryRoot
+    desc: "ruta absoluta al directorio raiz del fn_registry (donde vive registry.db)"
+output: "slice de ArtefactCheck, uno por artefacto. Cada entrada incluye ID, Type, DirPath, lista de Issues y campo OK. Error solo si la BD no se puede abrir."
+tested: true
+tests:
+  - "TestArtefactDoctor_DetectsMissingDir"
+  - "TestArtefactDoctor_OKArtefact"
+test_file_path: "functions/infra/artefact_doctor_test.go"
+file_path: "functions/infra/artefact_doctor.go"
+---
+
+## Ejemplo
+
+```go
+checks, err := ArtefactDoctor("/home/lucas/fn_registry")
+if err != nil {
+    log.Fatal(err)
+}
+for _, c := range checks {
+    if !c.OK {
+        fmt.Printf("[%s] %s: %v\n", c.Type, c.ID, c.Issues)
+    }
+}
+```
+
+## Issues posibles
+
+| Issue | Causa |
+|---|---|
+| `directory_missing` | `dir_path` del artefacto no existe en disco |
+| `git_not_initialized` | Falta `.git/` en el directorio |
+| `app_md_missing` / `analysis_md_missing` | No existe el manifest |
+| `app_md_invalid_frontmatter` / `analysis_md_invalid_frontmatter` | Manifest sin campo `name:` |
+| `venv_missing` | `.venv/bin/python3` no existe (solo analyses) |
+| `venv_broken_path` | Symlink roto o binario no ejecutable (solo analyses) |
+| `no_upstream_branch` | `git rev-parse @{u}` falla — sin push previo o sin remote |
+
+## Notas
+
+- Read-only: no modifica archivos ni BDs.
+- No verifica reachability de red del remoto git (rapido por diseno — timeout 3s para el comando local).
+- Usa `exec.CommandContext` con timeout de 3 segundos para el check de git upstream.
+- `dir_path` en registry.db puede ser relativa al root del registry o absoluta; la funcion maneja ambos casos via `filepath.Join`.
+- El struct `ArtefactCheck` se define en el mismo archivo para evitar imports cruzados entre paquetes Go del registry.