[pending-judge] fix(r4): audit contract, subdomain forwarding, timeout kill (judge r3 blockers)

BLOCK0: catalog deploy audit now uses the REAL AuditLogger contract
(auditLogger.log({action,resource,details,outcome,ip})) fire-and-forget
via Promise.resolve().catch — async audit failures can never fail the
deploy response (tested with a throwing audit backend).
BLOCK1: verify.sh targeted-jest block captures jest exit code explicitly
(set +e / rc / loud FAIL) — no silent termination under set -e.
BLOCK2: subdomain advertised by the App Selector modal is now FORWARDED
end-to-end (selector -> /deploys/catalog/deploy validated charset ->
bridge --subdomain -> CLI CatalogInstallOptions, implemented in
dc-catalog-2 r3); invalid subdomains 400 before the bridge (4 cases).
POLISH: boot-timeout SIGKILLs the child (no leaked process).
New r4 suite: 7 tests (audit shape success/failure, subdomain forward +
4 rejections). Full suite 157 suites / 3519 tests green.

dashcaddy-api/__tests__/routes/deploys.catalog.test.js

@@ -29,7 +29,7 @@ function makeApp(bridgeResponses) {
   };
   const log = { info() {}, error() {}, warn() {} };
   const audits = [];
-  const auditLogger = (action, meta) => audits.push({ action, meta });
+  const auditLogger = { log: async (entry) => { audits.push(entry); } };
   const e = express();
   e.use(express.json());
   const asyncHandler = (fn) => async (req, res, next) => {
@@ -61,8 +61,10 @@ describe('DC-CATALOG-3: /deploys/catalog endpoints', () => {
     expect(res.body.port).toBe(32400);
     expect(calls[0].key).toBe('POST /api/catalog/deploy');
     expect(calls[0].body).toMatchObject({ app: 'plex', port: 32400, env: { PLEX_CLAIM: 'claim-x' } });
+    // r4: audit via the real contract auditLogger.log({action,...})
     expect(audits[0].action).toBe('deploy.catalog');
-    expect(audits[0].meta.ok).toBe(true);
+    expect(audits[0].details.ok).toBe(true);
+    expect(audits[0].outcome).toBe('success');
   });
 
   it.each([