[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

Committed by Hermes autonomous QA sprint 2026-08-13.
These files were modified during the Aug 12 sprint but never committed.

dashcaddy-installer/install.sh

@@ -835,6 +835,22 @@ start_caddy() {
   fi
 }
 
+# DC-037: Make API source reachable from both the install path
+# (${SITES_DIR}/dashcaddy-api, where this installer writes files) and the
+# /opt/dashcaddy/dashcaddy-api path that the auto-updater and several runtime
+# helpers default to. Without this, a first auto-update lands on a fresh host
+# that wrote its API files to ${SITES_DIR}/dashcaddy-api but tried to read
+# from /opt/dashcaddy/dashcaddy-api and crashes with
+# `cp: cannot create directory '/etc/dashcaddy/sites/dashcaddy-api/routes':
+# No such file or directory` because the trailing parent path is missing.
+# `ln -sfn` is idempotent (safe on re-runs; does not fail if the link already
+# points to the same target) and replaces any stale link.
+install_api_symlink() {
+  mkdir -p /opt/dashcaddy
+  ln -sfn "${API_DIR}" /opt/dashcaddy/dashcaddy-api
+  ok "API symlink: /opt/dashcaddy/dashcaddy-api -> ${API_DIR}"
+}
+
 # ============================================================================
 # Firewall
 # ============================================================================
@@ -1091,6 +1107,7 @@ main() {
   # ---- Step 7: Start Caddy ----
   step "Starting web server"
   start_caddy
+  install_api_symlink
 
   print_success "$(elapsed "$start_time")"
 }