DC-005: Fix all 138 broken test paths after src/ refactor

After the DC-005 module reorganization (41 files moved into src/ subdirs),
138 test suites failed because the refactor script's path-rewrite logic
missed three categories:

1. Files inside src/ doing 'require("./src/...")' — should be 'require("../...")'
2. Files in src/X/Y/ doing 'require("../../../src/...")' — should be 'require("../../...")'
3. Test files in __tests__/ with leftover 'require("../../../src/...")' paths

Root cause: the original refactor script ran before all files were moved,
so it computed relative paths against stale filesystem state.

Result:
- 30/30 test suites pass
- 879/879 tests pass (was: 18/30 suites, 614/687 tests)

Also fixed:
- routes/apps/restore.js: wrong responses import path
- routes/*/*.js: '../../src/utilities/X' → '../src/utilities/X' (depth 2 routes)

dashcaddy-api/src/utilities/config-schema.js

@@ -0,0 +1,141 @@
+/**
+ * Config Schema Validation for DashCaddy
+ * Validates config.json structure to catch typos and invalid values early.
+ */
+
+const VALID_TIMEZONES_SAMPLE = [
+  'UTC', 'America/New_York', 'America/Chicago', 'America/Denver', 'America/Los_Angeles',
+  'Europe/London', 'Europe/Paris', 'Europe/Berlin', 'Asia/Tokyo', 'Asia/Shanghai',
+  'Asia/Singapore', 'Australia/Sydney', 'Pacific/Auckland'
+];
+
+/**
+ * Validate a config object and return errors/warnings.
+ * @param {object} config - The config object to validate
+ * @returns {{ valid: boolean, errors: string[], warnings: string[] }}
+ */
+function validateConfig(config) {
+  const errors = [];
+  const warnings = [];
+
+  if (!config || typeof config !== 'object') {
+    return { valid: false, errors: ['Config must be a non-null object'], warnings };
+  }
+
+  // TLD validation
+  if (config.tld !== undefined) {
+    if (typeof config.tld !== 'string') {
+      errors.push('tld must be a string');
+    } else {
+      const tld = config.tld.startsWith('.') ? config.tld : '.' + config.tld;
+      if (!/^\.[a-z0-9][a-z0-9-]*$/.test(tld)) {
+        errors.push(`tld "${config.tld}" contains invalid characters (use lowercase alphanumeric)`);
+      }
+      if (tld.length > 20) {
+        warnings.push(`tld "${config.tld}" is unusually long`);
+      }
+    }
+  }
+
+  // DNS config validation
+  if (config.dns !== undefined) {
+    if (typeof config.dns !== 'object' || config.dns === null) {
+      errors.push('dns must be an object');
+    } else {
+      if (config.dns.ip !== undefined && typeof config.dns.ip !== 'string') {
+        errors.push('dns.ip must be a string');
+      }
+      if (config.dns.ip && !/^[\d.]+$/.test(config.dns.ip) && !/^[a-zA-Z0-9.-]+$/.test(config.dns.ip)) {
+        errors.push(`dns.ip "${config.dns.ip}" is not a valid IP address or hostname`);
+      }
+      if (config.dns.port !== undefined) {
+        const port = parseInt(config.dns.port, 10);
+        if (isNaN(port) || port < 1 || port > 65535) {
+          errors.push(`dns.port "${config.dns.port}" is not a valid port number (1-65535)`);
+        }
+      }
+      if (config.dns.servers !== undefined) {
+        if (typeof config.dns.servers !== 'object' || config.dns.servers === null) {
+          errors.push('dns.servers must be an object');
+        }
+      }
+      // DNS provider validation
+      if (config.dns.provider !== undefined) {
+        const validProviders = ['technitium', 'cloudflare', 'rfc2136', 'manual'];
+        if (typeof config.dns.provider !== 'string') {
+          errors.push('dns.provider must be a string');
+        } else if (!validProviders.includes(config.dns.provider)) {
+          warnings.push(`dns.provider "${config.dns.provider}" is not one of: ${validProviders.join(', ')}. It may still work if a custom adapter is installed.`);
+        }
+      }
+    }
+  }
+
+  // Dashboard host validation
+  if (config.dashboardHost !== undefined) {
+    if (typeof config.dashboardHost !== 'string') {
+      errors.push('dashboardHost must be a string');
+    } else if (config.dashboardHost && !/^[a-zA-Z0-9][a-zA-Z0-9.-]*$/.test(config.dashboardHost)) {
+      errors.push(`dashboardHost "${config.dashboardHost}" contains invalid characters`);
+    }
+  }
+
+  // Timezone validation
+  if (config.timezone !== undefined) {
+    if (typeof config.timezone !== 'string') {
+      errors.push('timezone must be a string');
+    } else if (config.timezone) {
+      // Basic format check — full validation would require Intl API
+      try {
+        Intl.DateTimeFormat(undefined, { timeZone: config.timezone });
+      } catch {
+        errors.push(`timezone "${config.timezone}" is not a recognized IANA timezone`);
+      }
+    }
+  }
+
+  // Theme validation
+  if (config.theme !== undefined) {
+    const validThemes = ['dark', 'light', 'blue'];
+    if (!validThemes.includes(config.theme)) {
+      warnings.push(`theme "${config.theme}" is not one of: ${validThemes.join(', ')}`);
+    }
+  }
+
+  // Routing mode validation
+  if (config.routingMode !== undefined) {
+    const validModes = ['subdomain', 'subdirectory'];
+    if (!validModes.includes(config.routingMode)) {
+      errors.push(`routingMode "${config.routingMode}" is not one of: ${validModes.join(', ')}`);
+    }
+  }
+
+  // Domain validation
+  if (config.domain !== undefined) {
+    if (typeof config.domain !== 'string') {
+      errors.push('domain must be a string');
+    } else if (config.domain && !/^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/i.test(config.domain)) {
+      warnings.push(`domain "${config.domain}" may not be a valid domain name`);
+    }
+  }
+
+  // Warn on unknown top-level keys
+  const knownKeys = [
+    'tld', 'caName', 'dns', 'dnsServers', 'dashboardHost', 'timezone', 'theme',
+    'updatedAt', 'timestamp', 'logo', 'logoPosition', 'favicon', 'weather',
+    'setupComplete', 'setupCompleted', 'setupMode', 'onboardingCompleted',
+    'configurationType', 'defaults', 'customLogo', 'customFavicon',
+    'dashboardTitle', 'tailscale', 'license', 'skipped',
+    'routingMode', 'domain', 'email', 'defaultIP', 'pylon',
+    'customLogoDark', 'customLogoLight'
+  ];
+  for (const key of Object.keys(config)) {
+    if (!knownKeys.includes(key)) {
+      warnings.push(`Unknown config key "${key}" — possible typo?`);
+    }
+  }
+
+  return { valid: errors.length === 0, errors, warnings };
+}
+
+module.exports = { validateConfig };