Fix auto-update pipeline bugs discovered in e2e testing

- Fix container-to-host path mapping in trigger.json (stagingDir
  was using container path /app/updates/ instead of host path
  /opt/dashcaddy/updates/)
- Fix download race condition: primary download's async unlink
  could delete mirror download's file — use unlinkSync before retry
- Fix DASHCADDY_COMMIT build arg not passed to docker compose build
  (was set as env var, now uses --build-arg)
- Remove MakeDirectory=yes from systemd path unit (was creating
  trigger.json as directory instead of file)
- Remove unused 'tar' npm module import
- Add mirror fallback for tarball downloads (not just version checks)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dashcaddy-api/scripts/build-release.sh

@@ -5,7 +5,7 @@
 
 set -euo pipefail
 
-readonly REPO_URL="http://100.98.123.59:3000/sami7777/dashcaddy.git"
+readonly REPO_URL="http://sami7777:2728bb667201841b08cb35ac101ffe52838f7d11@100.98.123.59:3000/sami7777/dashcaddy.git"
 readonly RELEASE_DIR="/var/www/get.dashcaddy.net/release"
 readonly BUILD_DIR="/tmp/dashcaddy-build-$$"
 readonly MIRROR_HOST="root@100.98.123.59"  # Contabo DE