[grade=B] test: sync auth and version contracts

dashcaddy-api/__tests__/self-updater-version.test.js

@@ -78,23 +78,19 @@ describe('SelfUpdater.getLocalVersion() — DC-033 regression', () => {
       }
     });
 
-    test('commit is a git SHA (7-40 hex chars), not null', () => {
+    test('commit contains a git SHA and is not null', () => {
       expect(result.commit).not.toBeNull();
-      expect(result.commit).toMatch(/^[0-9a-f]{7,40}$/);
+      expect(result.commit).toMatch(/(?:^|-)[0-9a-f]{7,40}$/);
     });
   });
 
-  describe('candidate-path resolution survives missing sibling files', () => {
-    // If we shadow __dirname by requiring the module through a different
-    // require() chain, the function should still find package.json via its
-    // candidate-list fallback. This catches the case where someone refactors
-    // the file to a deeper subdirectory and forgets to update the candidates.
-    test('getLocalVersion works regardless of how the module is required', () => {
+  describe('repeat construction uses the same resolved metadata', () => {
+    test('a second instance resolves the same non-fallback version metadata', () => {
       const mod = require(path.join(API_ROOT, 'src', 'docker', 'self-updater.js'));
       const Cls = mod.SelfUpdater || mod.default || mod;
       const result = new Cls({}).getLocalVersion();
       expect(result.version).not.toBe('0.0.0');
-      expect(result.commit).toMatch(/^[0-9a-f]{7,40}$/);
+      expect(result.commit).toMatch(/(?:^|-)[0-9a-f]{7,40}$/);
     });
   });
 });