Merge krystie-improvements into main

Resolves 24 conflicts between Hermes (DC-008/009/010 + response-helper
envelope standardization) and Krystie (DC-005 src/ refactor path fixes,
DC-006 TOTP integration, DC-007 new test suites, cloud backup
destinations).

Conflict resolutions:
- src/utils/logging.js:    took ours (consumers depend on logError/
                            safeErrorMessage/createLogger exports)
- src/config/site.js:      merged (her factored validateAndLogConfig +
                            applyConfigFields helpers)
- src/context/dns.js:      took hers (admin/readonly role iteration for
                            write operations)
- src/utilities/backup-
  manager.js:              took hers (Dropbox/WebDAV/SFTP cloud feature)
- status/dist/*, status/
  sw.js:                   took hers (minified bundles + newer SW cache)

Additional fix (post-merge regression):
- src/monitoring/health-checker.js: fixed DC-005 path miss —
  'require(./platform-paths)' → 'require(../../platform-paths)'

Test status: 921/922 passing. One known failure in logging.test.js
(async file-handle timing) tracked as follow-up.

dashcaddy-api/routes/updates.js

@@ -1,6 +1,7 @@
 const express = require('express');
-const { paginate, parsePaginationParams } = require('../pagination');
-const { ValidationError } = require('../errors');
+const { paginate, parsePaginationParams } = require('../src/utilities/pagination');
+const { ValidationError } = require('../src/utilities/errors');
+const { ok, successMessage } = require('../src/utils/responses');
 
 /**
  * Updates route factory
@@ -41,7 +42,7 @@ module.exports = function({ updateManager, selfUpdater, asyncHandler, logError,
   // Rollback update
   router.post('/updates/rollback/:containerId', asyncHandler(async (req, res) => {
     await updateManager.rollbackUpdate(req.params.containerId);
-    ok(res, { message: 'Rollback completed' });
+    successMessage(res, 'Rollback completed');
   }, 'updates-rollback'));
 
   // Get update history
@@ -57,7 +58,7 @@ module.exports = function({ updateManager, selfUpdater, asyncHandler, logError,
   // Configure auto-update
   router.post('/updates/auto-update/:containerId', asyncHandler(async (req, res) => {
     updateManager.configureAutoUpdate(req.params.containerId, req.body);
-    ok(res, { message: 'Auto-update configured' });
+    successMessage(res, 'Auto-update configured');
   }, 'updates-auto-update'));
 
   // Get auto-update configuration
@@ -87,14 +88,14 @@ module.exports = function({ updateManager, selfUpdater, asyncHandler, logError,
   // Check for DashCaddy update
   router.get('/system/update-check', asyncHandler(async (req, res) => {
     const result = await selfUpdater.checkForUpdate();
-    ok(res, { ...result });
+    ok(res, result);
   }, 'system-update-check'));
 
   // Apply available update
   router.post('/system/update-apply', asyncHandler(async (req, res) => {
     const check = await selfUpdater.checkForUpdate();
     if (!check.available) {
-      return ok(res, { message: 'Already up to date' });
+      return successMessage(res, 'Already up to date');
     }
     // Refuse same-version applies. The check.available flag can theoretically be
     // true with equal versions (commit-mismatch path); applying anyway just
@@ -135,7 +136,7 @@ module.exports = function({ updateManager, selfUpdater, asyncHandler, logError,
       return res.status(401).json({ success: false, error: 'Invalid notify secret' });
     }
     const result = selfUpdater.notifyAndApply('http-notify');
-    ok(res, { ...result });
+    ok(res, result);
   }, 'system-update-notify'));
 
   // Get update status