diff --git a/dashcaddy-api/routes/apps/restore.js b/dashcaddy-api/routes/apps/restore.js
index 8cfe579..81e1434 100644
--- a/dashcaddy-api/routes/apps/restore.js
+++ b/dashcaddy-api/routes/apps/restore.js
@@ -21,7 +21,8 @@ const DEFAULT_BACKUP_DIR = process.env.BACKUP_DIR || path.join(__dirname, '..',
  * @param {Function} deps.buildServiceUrl - Service URL builder
  * @returns {express.Router}
  */
-module.exports = function({ docker, caddy, servicesStateManager, asyncHandler, errorResponse, log, helpers, APP_TEMPLATES, dns, buildServiceUrl }) {
+module.exports = function({ docker, caddy, servicesStateManager, asyncHandler, errorResponse, log, helpers, APP_TEMPLATES, dns, buildServiceUrl, backupManager }) {
+  if (!backupManager) throw new Error('routes/apps/restore: backupManager dependency is required');
   const router = express.Router();
 
   const ctx = {
diff --git a/dashcaddy-api/routes/dns.js b/dashcaddy-api/routes/dns.js
index 2768601..ed1528c 100644
--- a/dashcaddy-api/routes/dns.js
+++ b/dashcaddy-api/routes/dns.js
@@ -552,7 +552,7 @@ module.exports = function({
         }
       }
 
-      return ok(res, {
+      return success(res, {
         message: anySuccess ? 'Credentials saved for one or more servers' : 'All server credential tests failed',
         results
       });
diff --git a/dashcaddy-api/src/utilities/middleware.js b/dashcaddy-api/src/utilities/middleware.js
index b3f2ace..e1a3316 100644
--- a/dashcaddy-api/src/utilities/middleware.js
+++ b/dashcaddy-api/src/utilities/middleware.js
@@ -402,11 +402,10 @@ module.exports = function configureMiddleware(app, {
     { path: '/api/v1/share/:token/preview',           exact: true,  method: 'GET' },
     { path: '/api/v1/share/:token/subscribe',         exact: true,  method: 'POST' },
     { path: '/api/v1/share/:token/redeem-tailscale',  exact: true,  method: 'POST' },
-    { path: '/api/v1/billing/checkout',              exact: true,  method: 'POST' },
-    // /api/v1/billing/webhook was REMOVED: webhooks are handled out-of-process
-    // by scripts/stripe-license-bridge.js (the merchant webhook secret never
-    // enters the API process). The PUBLIC_ROUTES allowlist drift test would
-    // catch any re-add of this dead entry.
+    // /api/v1/billing/* was REMOVED: billing is handled out-of-process
+    // (the merchant webhook secret never enters the API process). The
+    // PUBLIC_ROUTES allowlist drift test guards against re-adding these
+    // dead entries.
     // /api/v1/services + status: read-only service metadata that the public
     // dashboard needs before login (services list widget, status pill).
     // Writes go through the normal auth gate. CSRF applies to writes as usual.