DC-020: restore license-keygen.js + fix broken require paths (container crash-loop)

The refactor(desloppify) commit a2e6566 deleted license-keygen.js and added it
to .gitignore, believing it was stale dev-root noise. It is actually a required
production module: src/managers/license-manager.js does require('./license-keygen')
and imports verifyCode/parseCode/VALID_DURATIONS. The deletion put the production
dashcaddy-api container in a crash-restart loop (MODULE_NOT_FOUND from
/app/src/app.js -> /app/server.js). The 1036-test suite passed because no test
ever executed require() on the real app module.

Fixes:
- Restore license-keygen.js from git history (a2e6566^) to src/managers/, the
  path the post-DC-005 require resolves to. CLI main() is require.main-guarded,
  so only the library exports are used at runtime.
- Remove the license-keygen.js line from .gitignore so the restored module is
  tracked (otherwise the fix would not survive a container rebuild).
- Fix a second masked broken require: src/docker/self-updater.js required
  './platform-paths' (resolves to src/docker/, doesn't exist) -> corrected to
  '../../platform-paths' (repo root, where all 9 other callers point).
- Add .encryption-key to .gitignore (runtime AES secret that the require graph
  regenerates; was untracked + un-ignored -> latent leak on git add -A).
- Add __tests__/app-startup-smoke.test.js: executes require() on the real app
  module and asserts the full require graph resolves. This regression guard
  would have caught both broken requires.

Verified: app module now loads clean; 1038/1038 tests pass (+2 new); the smoke
test fails if either required module is missing.

dashcaddy-api/__tests__/app-startup-smoke.test.js

@@ -0,0 +1,29 @@
+/**
+ * App startup require-graph smoke test (DC-020 regression guard)
+ *
+ * WHY THIS EXISTS:
+ *   The `refactor(desloppify)` commit deleted `license-keygen.js` thinking it was
+ *   stale dev-root noise. It is actually required by `src/managers/license-manager.js`
+ *   (`require('./license-keygen')`). The deletion put the production `dashcaddy-api`
+ *   container in a crash-restart loop (MODULE_NOT_FOUND from /app/src/app.js). The
+ *   full Jest suite (1036 tests) passed anyway because NO test ever executed
+ *   `require()` on the real app module — every "app" test read src/app.js as a
+ *   string or rebuilt a minimal Express app with copied handlers.
+ *
+ *   This test closes that gap: it executes the real production require graph and
+ *   asserts it resolves without throwing. Any future deletion of a required module,
+ *   or any broken relative require, will fail here instead of crashing the container
+ *   on the next deploy.
+ */
+const path = require('path');
+
+describe('app startup require-graph smoke', () => {
+  it('src/app.js and its entire require graph load without throwing', () => {
+    expect(() => require(path.join(__dirname, '..', 'src', 'app'))).not.toThrow();
+  });
+
+  it('createApp is exported as a function', () => {
+    const mod = require(path.join(__dirname, '..', 'src', 'app'));
+    expect(typeof mod.createApp).toBe('function');
+  });
+});