fix(server): DC-058 close 3 P0 bugs — restore.js missing dep, dns.js ok ref, dead /billing/checkout

1. routes/apps/restore.js: backupManager was being passed by the
   aggregator (routes/apps/index.js:58) but never destructured in the
   factory signature. Every apps/restore request 500'd with
   ReferenceError. Added backupManager to the destructure + an explicit
   throw if missing so the next regression surfaces at startup instead
   of at the first call.

2. routes/dns.js:555: file imports { success, error } from
   ../src/utils/responses but used ok(res, ...) (defunct alias). DNS
   credential save path 500'd. Changed to success() to match the rest
   of the file.

3. src/utilities/middleware.js: deleted /api/v1/billing/checkout from
   PUBLIC_ROUTES — dead entry, no route mounted. Drift test caught it
   (DC-017 guard). Updated the comment to cover both checkout + webhook
   as removed.

Tests: 1428/1428 pass (drift test now green).
Lint: 0 no-undef errors across src/ + routes/ (was 7).

Refs: DashCaddy audit 2026-08-02

dashcaddy-api/src/utilities/middleware.js

@@ -402,11 +402,10 @@ module.exports = function configureMiddleware(app, {
     { path: '/api/v1/share/:token/preview',           exact: true,  method: 'GET' },
     { path: '/api/v1/share/:token/subscribe',         exact: true,  method: 'POST' },
     { path: '/api/v1/share/:token/redeem-tailscale',  exact: true,  method: 'POST' },
-    { path: '/api/v1/billing/checkout',              exact: true,  method: 'POST' },
-    // /api/v1/billing/webhook was REMOVED: webhooks are handled out-of-process
-    // by scripts/stripe-license-bridge.js (the merchant webhook secret never
-    // enters the API process). The PUBLIC_ROUTES allowlist drift test would
-    // catch any re-add of this dead entry.
+    // /api/v1/billing/* was REMOVED: billing is handled out-of-process
+    // (the merchant webhook secret never enters the API process). The
+    // PUBLIC_ROUTES allowlist drift test guards against re-adding these
+    // dead entries.
     // /api/v1/services + status: read-only service metadata that the public
     // dashboard needs before login (services list widget, status pill).
     // Writes go through the normal auth gate. CSRF applies to writes as usual.