feat(security): activate caddy security-event pipeline — bounded first-start replay, self-noise filter, host fidelity (DC-113) [glm-grade=A]

The caddy tail worker (DC-112) was 100% dead in prod: no /var/log/caddy
mount, no CADDY_ACCESS_LOG env, no global access log in the Caddyfile.
Store census 45,912 events, 100% source_type 'api', ZERO 'caddy'.

- createTail: firstStartMaxBytes (5 MiB) bounds first-ever-start replay
  against a long-lived access.log; multi-chunk partial-line discard on
  the jump; normal restarts resume at exact persisted offset (judge r1
  fix-first fold)
- worker: self-noise filter drops our own probe UAs
  (DashCaddy-Probe/1.0, DashCaddy-HealthCheck/1.0) from the derived
  store — raw log keeps everything; ~50-100 events/min of probe noise
  would otherwise bury perimeter signal in the 100k-cap store
- worker: metadata.host reads request.host (real caddy JSON nests it;
  verified against live /var/log/caddy/seeds.log — the DC-112 read was
  always null on live lines); top-level fallback kept
- worker: onAppear recovery log (DC-112 judge polish fold)
- start.sh: -v /var/log/caddy:/var/log/caddy:ro + CADDY_ACCESS_LOG env
- README: dead caddy-api/ dir refs -> dashcaddy-api/ (queue item e)
- tests: +12 DC-113 pins (hermetic, real worker + store); DC-112
  fixtures corrected to the real nested request.host shape

126 suites / 2841 tests green. Judge: GLM-5.3 round-1 B, round-2 A
(SHIP). Verdict urn:ump:mccln523fptotuvrmddlqpf4zpkrxf273tg4kyytuyy3776rj3pq

README.md

@@ -355,9 +355,9 @@ dashcaddy/
 ├── status/                 # Dashboard frontend
 │   ├── index.html         # Main dashboard
 │   └── assets/            # Logos, icons, fonts
-├── caddy-api/             # API backend
+├── dashcaddy-api/         # API backend
 │   ├── server.js          # Express server
-│   ├── app-templates.js   # App template definitions
+│   ├── src/docker/app-templates.js   # App template definitions
 │   └── package.json       # Dependencies
 ├── dashcaddy-installer/   # Electron installer (WIP)
 └── docs/                  # Documentation
@@ -365,7 +365,7 @@ dashcaddy/
 
 ### Adding Custom App Templates
 
-Edit `caddy-api/app-templates.js`:
+Edit `dashcaddy-api/src/docker/app-templates.js`:
 
 ```javascript
 "myapp": {