feat(security): activate caddy security-event pipeline — bounded first-start replay, self-noise filter, host fidelity (DC-113) [glm-grade=A]

The caddy tail worker (DC-112) was 100% dead in prod: no /var/log/caddy
mount, no CADDY_ACCESS_LOG env, no global access log in the Caddyfile.
Store census 45,912 events, 100% source_type 'api', ZERO 'caddy'.

- createTail: firstStartMaxBytes (5 MiB) bounds first-ever-start replay
  against a long-lived access.log; multi-chunk partial-line discard on
  the jump; normal restarts resume at exact persisted offset (judge r1
  fix-first fold)
- worker: self-noise filter drops our own probe UAs
  (DashCaddy-Probe/1.0, DashCaddy-HealthCheck/1.0) from the derived
  store — raw log keeps everything; ~50-100 events/min of probe noise
  would otherwise bury perimeter signal in the 100k-cap store
- worker: metadata.host reads request.host (real caddy JSON nests it;
  verified against live /var/log/caddy/seeds.log — the DC-112 read was
  always null on live lines); top-level fallback kept
- worker: onAppear recovery log (DC-112 judge polish fold)
- start.sh: -v /var/log/caddy:/var/log/caddy:ro + CADDY_ACCESS_LOG env
- README: dead caddy-api/ dir refs -> dashcaddy-api/ (queue item e)
- tests: +12 DC-113 pins (hermetic, real worker + store); DC-112
  fixtures corrected to the real nested request.host shape

126 suites / 2841 tests green. Judge: GLM-5.3 round-1 B, round-2 A
(SHIP). Verdict urn:ump:mccln523fptotuvrmddlqpf4zpkrxf273tg4kyytuyy3776rj3pq

start.sh

@@ -160,6 +160,7 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
   -v ${BACKUPS_DIR}:/app/backups \
   -v ${CADDYFILE}:/caddyfile \
   -v /etc/caddy/sites:/etc/caddy/sites:ro \
+  -v /var/log/caddy:/var/log/caddy:ro \
   -v /var/run/docker.sock:/var/run/docker.sock \
   -v ${ASSETS_DIR}:/app/assets \
   -v ${UPDATES_DIR}:/app/updates \
@@ -180,6 +181,7 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
   -e HEALTH_CONFIG_FILE=/app/data/health-config.json \
   -e CADDYFILE_PATH=/caddyfile \
   -e CADDY_ADMIN_URL=http://${HOST_IP}:2019 \
+  -e CADDY_ACCESS_LOG=/var/log/caddy/access.log \
   -e ASSETS_DIR=/app/assets \
   -e DASHCADDY_API_SOURCE_DIR=/opt/dashcaddy/dashcaddy-api \
   -e DASHCADDY_UPDATE_ENABLED=false \