chore: ignore runtime data + scratch files, remove dead root routes/

Working tree accumulated 172 untracked/modified files from the auto-updater:
- 19 secret/runtime files in dashcaddy-api/data/ that should never be tracked
- 199 byte-identical duplicates of tracked files dumped at root by an
  outdated rsync/cp step
- 6 scratch debug scripts (cm_check.js, login_test.js, full_test.js, ...)
- 7 .bak-* files from start.sh and dashcaddy-update.sh rollback branches
- Root-level routes/ directory: dead code, container COPYs dashcaddy-api/routes/

.gitignore now ignores:
  - dashcaddy-api/data/          (runtime: credentials, secrets, history)
  - start.sh.bak*, scripts/*.bak* (auto-updater rollback backups)
  - updates/                      (auto-updater runtime state)
  - cm_check*.js, *_test.js       (scratch debug scripts)

Removed dead code:
  - routes/openclaw.js            (replaced by dashcaddy-api/routes/openclaw.js)

Recreated runtime scripts that were deleted with their duplicates:
  - start.sh                      (canonical container-start, 47-line full config)
  - scripts/dashcaddy-update.sh was already untracked; fixed the tracked
    dashcaddy-api/scripts/dashcaddy-update.sh instead (see next commit)

Net change: 172 → 17 files in working tree.

.gitignore

@@ -2,6 +2,8 @@
 node_modules/
 
 # Runtime state/config files (generated, not source)
+# Note: data/ subdir contains runtime state (credentials, secrets, history) — never commit
+dashcaddy-api/data/
 dashcaddy-api/credentials.json
 dashcaddy-api/.env
 .env
@@ -17,6 +19,19 @@ dashcaddy-api/update-config.json
 dashcaddy-api/update-history.json
 dashcaddy-api/dashcaddy-errors.log
 
+# Auto-updater backups (created by dashcaddy-update.sh when rolling back)
+start.sh.bak*
+scripts/*.bak*
+
+# Auto-updater runtime state (history + secrets + staging)
+updates/
+
+# Scratch / debug scripts (left over from past sessions)
+cm_check*.js
+full_test.js
+login_test.js
+login_backup_test.js
+
 # Build output
 dashcaddy-installer/build-output/
 dashcaddy-installer/dist/