[pending-judge] fix(integration): catalog detail reads app.docker.* (DC-160); Shield committed; composition-root e2e

- DC-160: /catalog/:appId read app.image/ports/env/volumes which live under
  app.docker.* — every detail response was empty. Now reads docker.* and
  surfaces defaultPort/subdomain/healthCheck/mediaMount/claimToken/difficulty/
  setupInstructions for the deploy form. List/search use the templates own
  category field (old hand-rolled CATEGORY_MAP mis-categorized apps).
- Shield (routes/shield.js + 5-line app.js mount) committed to source after
  weeks as prod-only drift; regression test asserts the mount exists.
- New composition-root e2e suite: boots REAL createApp() on an ephemeral
  port, probes the historically-broken routes through the REAL mount table
  (wizard wiring, shield, catalog detail, deploys bridge) — the class of bug
  all 3 P7 dogfood findings belonged to. 5 tests.
- Full suite 3499/3499 (155 suites); table-driven DC-160 test covers all 73
  image templates.

dashcaddy-api/src/app.js

@@ -974,6 +974,11 @@ async function createApp() {
     log: ctx.log,
   }));
 
+  // DC-Shield: per-app security badges from the sec-dashboard snapshot.
+  apiRouter.use('/security', require('../routes/shield')({
+    log: ctx.log,
+  }));
+
   // DC-130: shipdeck deploys — source deploys via the host-side bridge.
   // Feature-flagged: 501 unless SHIPDECK_BRIDGE_URL is set (opt-in pattern).
   apiRouter.use('/deploys', deploysRoutes({