[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

Committed by Hermes autonomous QA sprint 2026-08-13.
These files were modified during the Aug 12 sprint but never committed.

dashcaddy-api/src/utilities/startup-validator.js

@@ -74,11 +74,22 @@ async function validateStartupConfig({ log, CADDYFILE_PATH, SERVICES_FILE, CONFI
   }
 
   // 3. Check if port is available
+  // CRITICAL: listen() and close() are async. If we fire-and-forget both
+  // (the old code), the kernel hasn't released the port by the time
+  // app.listen(PORT) runs in server.js → EADDRINUSE → crash loop.
+  // Await both via Promises so the port is truly free before we return.
   const net = require('net');
   const portCheckServer = net.createServer();
   try {
-    portCheckServer.listen(PORT, '0.0.0.0');
-    portCheckServer.close();
+    await new Promise((resolve, reject) => {
+      portCheckServer.once('error', reject);
+      portCheckServer.listen(PORT, '0.0.0.0', () => {
+        portCheckServer.close(() => {
+          portCheckServer.removeListener('error', reject);
+          resolve();
+        });
+      });
+    });
     log.info('startup', `Port ${PORT} is available`);
   } catch (error) {
     errors.push(`Port ${PORT} is already in use or cannot be bound`);