[grade=B] DC-081: Input validation for 20 highest-risk mutating routes

Secures 20 mutating routes across 7 files against path traversal, shell
injection, and ReDoS vectors:
- containers.js: container ID validation + resource limit bounds (6 routes)
- recipes/manage.js: recipe ID slug validation (4 routes)
- tailscale.js: subdomain regex before interpolation + shell char blocking (2)
- workflows.js: workflow ID slug validation (3 routes)
- dependencies.js: service ID + dependsOn array validation (3 routes)
- logs.js: YYYY-MM-DD date format validation (1 route)
- sites.js: additional domain validation (1 route)

Uses existing REGEX patterns from constants.js. No new dependencies.
Codex: B (no blocking issues, 4 Low follow-ups for tests + strict bools).
1552/1552 tests pass, 0 regressions.

dashcaddy-api/routes/sites.js

@@ -135,6 +135,10 @@ module.exports = function({ asyncHandler, ok, caddy, dns, fetchT, buildDomain, a
   router.delete('/site/:domain', asyncHandler(async (req, res) => {
     const { domain } = req.params;
     if (!domain) throw new ValidationError('Domain is required');
+    // Validate domain format before it is escaped and interpolated into a regex
+    if (!REGEX.DOMAIN.test(domain)) {
+      throw new ValidationError('[DC-301] Invalid domain format');
+    }
 
     const result = await caddy.modify((content) => {
       const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');