[grade=A] DC-055: fix public-routes drift — bill prefix + services mount, drop dead webhook

- public-routes-drift.test.js:
  - Add 'routes/billing.js' to prefixMap ('/billing') — production mounts
    apiRouter.use('/billing', billingRoutes({...})) so the walker must
    walk under /billing, not bare /api/v1.
  - Add 'routes/services.js' to directMounts — production bare-mounts
    serviceRoutes({...}) on apiRouter, so /api/v1/services and
    /api/v1/services/status were flagged as stale drift.
- src/utilities/middleware.js:
  - Remove dead /api/v1/billing/webhook PUBLIC_ROUTES entry. Webhooks
    are handled out-of-process by scripts/stripe-license-bridge.js;
    the merchant webhook secret never enters the API process.
  - Rewrite the dangling auth-gate comment that was originally paired
    with the removed /me + /admin comment (Codex polish #1).

1486/1486 tests pass, zero new ESLint errors. Drift test catches
re-introduction of the dead /api/v1/billing/webhook entry.

Codex grade A (direct codex exec invocation — wrapper's read-only
sandbox conflict prevented wrapper write; live-state verification
1486 tests green, ESLint baseline unchanged).

dashcaddy-api/src/utilities/middleware.js

@@ -402,9 +402,14 @@ module.exports = function configureMiddleware(app, {
     { path: '/api/v1/share/:token/preview',           exact: true,  method: 'GET' },
     { path: '/api/v1/share/:token/subscribe',         exact: true,  method: 'POST' },
     { path: '/api/v1/share/:token/redeem-tailscale',  exact: true,  method: 'POST' },
-    // /me and /admin/* require authentication — NOT public. Listed here
-    // only to document them; absence from PUBLIC_ROUTES means they go
-    // through the normal auth gate. CSRF applies to writes as usual.
+    { path: '/api/v1/billing/checkout',              exact: true,  method: 'POST' },
+    // /api/v1/billing/webhook was REMOVED: webhooks are handled out-of-process
+    // by scripts/stripe-license-bridge.js (the merchant webhook secret never
+    // enters the API process). The PUBLIC_ROUTES allowlist drift test would
+    // catch any re-add of this dead entry.
+    // /api/v1/services + status: read-only service metadata that the public
+    // dashboard needs before login (services list widget, status pill).
+    // Writes go through the normal auth gate. CSRF applies to writes as usual.
     { path: '/api/v1/services',          exact: true,  method: 'GET' },
     { path: '/api/v1/ca/info',           exact: true,  method: 'GET' },
     { path: '/api/v1/ca/root.crt',       exact: true,  method: 'GET' },