Merge krystie-improvements into main

Resolves 24 conflicts between Hermes (DC-008/009/010 + response-helper
envelope standardization) and Krystie (DC-005 src/ refactor path fixes,
DC-006 TOTP integration, DC-007 new test suites, cloud backup
destinations).

Conflict resolutions:
- src/utils/logging.js:    took ours (consumers depend on logError/
                            safeErrorMessage/createLogger exports)
- src/config/site.js:      merged (her factored validateAndLogConfig +
                            applyConfigFields helpers)
- src/context/dns.js:      took hers (admin/readonly role iteration for
                            write operations)
- src/utilities/backup-
  manager.js:              took hers (Dropbox/WebDAV/SFTP cloud feature)
- status/dist/*, status/
  sw.js:                   took hers (minified bundles + newer SW cache)

Additional fix (post-merge regression):
- src/monitoring/health-checker.js: fixed DC-005 path miss —
  'require(./platform-paths)' → 'require(../../platform-paths)'

Test status: 921/922 passing. One known failure in logging.test.js
(async file-handle timing) tracked as follow-up.

dashcaddy-api/routes/events.js

@@ -1,4 +1,5 @@
 const express = require('express');
+const { ok } = require('../src/utils/responses');
 
 /**
  * Server-Sent Events route factory
@@ -8,10 +9,14 @@ const express = require('express');
  * @param {Object} deps.healthChecker - Health checker
  * @param {Object} deps.updateManager - Update manager
  * @param {Function} deps.logError - Error logging function
- * @param {Function} deps.ok - Success response helper
+ * @param {Object} deps.dependencyManager - Dependency manager for restart chain events
+ * @param {Object} deps.autoRestartManager - Auto-restart manager
+ * @param {Object} deps.driftDetector - Config drift detector
+ * @param {Object} deps.sslMonitor - SSL cert expiration monitor
+ * @param {Object} deps.dnsPropagationChecker - DNS propagation checker
  * @returns {express.Router}
  */
-module.exports = function({ resourceMonitor, healthChecker, updateManager, logError, ok }) {
+module.exports = function({ resourceMonitor, healthChecker, updateManager, logError, dependencyManager, autoRestartManager, driftDetector, sslMonitor, dnsPropagationChecker }) {
   const router = express.Router();
   const clients = new Set();
 
@@ -75,6 +80,48 @@ module.exports = function({ resourceMonitor, healthChecker, updateManager, logEr
     });
   }
 
+  // Dependency manager events
+  if (dependencyManager) {
+    dependencyManager.on('dependency-restart-start', (data) => {
+      broadcast('dependency-restart-start', data);
+    });
+    dependencyManager.on('dependency-restart-progress', (data) => {
+      broadcast('dependency-restart-progress', data);
+    });
+    dependencyManager.on('dependency-restart-complete', (data) => {
+      broadcast('dependency-restart-complete', data);
+    });
+    dependencyManager.on('dependency-restart-failed', (data) => {
+      broadcast('dependency-restart-failed', data);
+    });
+  }
+
+  // Auto-restart manager events
+  if (autoRestartManager) {
+    autoRestartManager.on('auto-restart-attempt', (data) => broadcast('auto-restart-attempt', data));
+    autoRestartManager.on('auto-restart-success', (data) => broadcast('auto-restart-success', data));
+    autoRestartManager.on('auto-restart-failed', (data) => broadcast('auto-restart-failed', data));
+    autoRestartManager.on('auto-restart-max-reached', (data) => broadcast('auto-restart-max-reached', data));
+  }
+
+  // Config drift detector events
+  if (driftDetector) {
+    driftDetector.on('drift-detected', (data) => broadcast('drift-detected', data));
+  }
+
+  // SSL monitor events
+  if (sslMonitor) {
+    sslMonitor.on('cert-expiring', (data) => broadcast('cert-expiring', data));
+    sslMonitor.on('cert-critical', (data) => broadcast('cert-critical', data));
+  }
+
+  // DNS propagation checker events
+  if (dnsPropagationChecker) {
+    dnsPropagationChecker.on('propagation-check', (data) => broadcast('dns-propagation-check', data));
+    dnsPropagationChecker.on('propagation-complete', (data) => broadcast('dns-propagation-complete', data));
+    dnsPropagationChecker.on('propagation-timeout', (data) => broadcast('dns-propagation-timeout', data));
+  }
+
   // SSE endpoint
   router.get('/stream', (req, res) => {
     res.writeHead(200, {