Standardize paths, add version endpoint, request timeouts, HOST env var, graceful shutdown

Cross-platform hardening — removes all hardcoded /app/ paths from route files
and routes them through platform-paths.js so the app works the same way
regardless of Docker layout (single-file mount vs consolidated data dir).

Changes:
- platform-paths.js: add generatedCertsDir, pkiDir, containerUpdatesDir,
  containerFrontendDir, containerAssetsDir, resolveAssetsPath()
- self-updater.js: UPDATE_URL/MIRROR_URL/CHANNEL env var overrides
- routes/ca.js: use platformPaths for cert paths and generated certs dir
- routes/services.js: use platformPaths.pkiRootCert
- routes/themes.js: derive THEMES_DIR from platformPaths.servicesFile
- routes/config/assets.js + backup.js: use resolveAssetsPath() fallback
- routes/services.js + src/app.js: use platformPaths.pkiRootCert
- server.js: HOST env var support, parse PORT as int
- src/app.js: GET /api/v1/version (public, no auth), global request timeout,
  disable x-powered-by, trust proxy
- pylon/dashcaddy-pylon.js: PYLON_HOST env var, graceful shutdown on SIGTERM/SIGINT

A fresh user can now deploy with a custom Docker layout (e.g. /opt/dc/data/
as a single volume mount) and the app finds its files automatically, no env
var configuration required.

dashcaddy-api/routes/config/assets.js

@@ -4,6 +4,7 @@ const path = require('path');
 const { LIMITS } = require('../../constants');
 const { exists } = require('../../fs-helpers');
 const { ValidationError } = require('../../errors');
+const platformPaths = require('../../platform-paths');
 /**
  * Config assets routes factory
  * @param {Object} deps - Explicit dependencies
@@ -51,7 +52,7 @@ module.exports = function({ servicesStateManager: _servicesStateManager, asyncHa
     const buffer = Buffer.from(base64Data, 'base64');
 
     // Determine assets path (mounted volume)
-    const assetsPath = process.env.ASSETS_PATH || '/app/assets';
+    const assetsPath = platformPaths.resolveAssetsPath(process.env.ASSETS_PATH);
 
     // Ensure directory exists
     if (!await exists(assetsPath)) {
@@ -96,7 +97,7 @@ module.exports = function({ servicesStateManager: _servicesStateManager, asyncHa
     const extension = matches[1] === 'svg+xml' ? 'svg' : matches[1];
     const buffer = Buffer.from(matches[2], 'base64');
 
-    const assetsPath = process.env.ASSETS_PATH || '/app/assets';
+    const assetsPath = platformPaths.resolveAssetsPath(process.env.ASSETS_PATH);
     if (!await exists(assetsPath)) {
       await fsp.mkdir(assetsPath, { recursive: true });
     }
@@ -170,7 +171,7 @@ module.exports = function({ servicesStateManager: _servicesStateManager, asyncHa
   // Reset all branding to defaults
   router.delete('/logo', asyncHandler(async (req, res) => {
     const config = await ctx.readConfig();
-    const assetsPath = process.env.ASSETS_PATH || '/app/assets';
+    const assetsPath = platformPaths.resolveAssetsPath(process.env.ASSETS_PATH);
 
     // Delete all custom logo files
     const logoPaths = [config.customLogo, config.customLogoDark, config.customLogoLight].filter(Boolean);
@@ -234,7 +235,7 @@ module.exports = function({ servicesStateManager: _servicesStateManager, asyncHa
     const base64Data = matches[2];
     const buffer = Buffer.from(base64Data, 'base64');
 
-    const assetsPath = process.env.ASSETS_PATH || '/app/assets';
+    const assetsPath = platformPaths.resolveAssetsPath(process.env.ASSETS_PATH);
     if (!await exists(assetsPath)) {
       await fsp.mkdir(assetsPath, { recursive: true });
     }
@@ -279,7 +280,7 @@ module.exports = function({ servicesStateManager: _servicesStateManager, asyncHa
     const config = await ctx.readConfig();
 
     // Delete custom favicon files
-    const assetsPath = process.env.ASSETS_PATH || '/app/assets';
+    const assetsPath = platformPaths.resolveAssetsPath(process.env.ASSETS_PATH);
     const filesToDelete = ['favicon.ico', 'favicon.png'];
     for (const file of filesToDelete) {
       const filePath = `${assetsPath}/${file}`;