DC-020: restore license-keygen.js + fix broken require paths (container crash-loop)

The refactor(desloppify) commit a2e6566 deleted license-keygen.js and added it
to .gitignore, believing it was stale dev-root noise. It is actually a required
production module: src/managers/license-manager.js does require('./license-keygen')
and imports verifyCode/parseCode/VALID_DURATIONS. The deletion put the production
dashcaddy-api container in a crash-restart loop (MODULE_NOT_FOUND from
/app/src/app.js -> /app/server.js). The 1036-test suite passed because no test
ever executed require() on the real app module.

Fixes:
- Restore license-keygen.js from git history (a2e6566^) to src/managers/, the
  path the post-DC-005 require resolves to. CLI main() is require.main-guarded,
  so only the library exports are used at runtime.
- Remove the license-keygen.js line from .gitignore so the restored module is
  tracked (otherwise the fix would not survive a container rebuild).
- Fix a second masked broken require: src/docker/self-updater.js required
  './platform-paths' (resolves to src/docker/, doesn't exist) -> corrected to
  '../../platform-paths' (repo root, where all 9 other callers point).
- Add .encryption-key to .gitignore (runtime AES secret that the require graph
  regenerates; was untracked + un-ignored -> latent leak on git add -A).
- Add __tests__/app-startup-smoke.test.js: executes require() on the real app
  module and asserts the full require graph resolves. This regression guard
  would have caught both broken requires.

Verified: app module now loads clean; 1038/1038 tests pass (+2 new); the smoke
test fails if either required module is missing.

dashcaddy-api/.gitignore

@@ -16,7 +16,6 @@ coverage/
 audit-routes.js
 comprehensive-test.js
 test-security-fixes.js
-license-keygen.js
 
 # Runtime-generated data files (written by the running server, not source)
 alert-config.json
@@ -31,6 +30,11 @@ health-history.json
 update-config.json
 update-history.json
 
+# Runtime secrets (never commit)
+.encryption-key
+*.encryption-key
+.encryption-key.bak
+
 # Runtime certificate/key directories
 generated-certs/
 pki/