[grade=B] DC-081: Input validation for 20 highest-risk mutating routes

Secures 20 mutating routes across 7 files against path traversal, shell
injection, and ReDoS vectors:
- containers.js: container ID validation + resource limit bounds (6 routes)
- recipes/manage.js: recipe ID slug validation (4 routes)
- tailscale.js: subdomain regex before interpolation + shell char blocking (2)
- workflows.js: workflow ID slug validation (3 routes)
- dependencies.js: service ID + dependsOn array validation (3 routes)
- logs.js: YYYY-MM-DD date format validation (1 route)
- sites.js: additional domain validation (1 route)

Uses existing REGEX patterns from constants.js. No new dependencies.
Codex: B (no blocking issues, 4 Low follow-ups for tests + strict bools).
1552/1552 tests pass, 0 regressions.

dashcaddy-api/routes/logs.js

@@ -176,6 +176,10 @@ module.exports = function({ asyncHandler, ok, docker, logDigest, dockerMaintenan
   router.post('/logs/digest/generate', asyncHandler(async (req, res) => {
     if (!logDigest) throw new Error('Log digest not available');
     const date = req.body.date || new Date().toISOString().slice(0, 10);
+    // Validate date format before passing to digest generator
+    if (typeof date !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(date)) {
+      throw new ValidationError('Invalid date format. Use YYYY-MM-DD.');
+    }
     const digest = await logDigest.generateDailyDigest(date);
     ok(res, { digest });
   }, 'logs-digest-generate'));