DC-050 harden dataDir + add image-layer migration

Three-part fix for the silent data-loss failure mode that survives DC-039:
If SERVICES_FILE env was unset, platformPaths.dataDir resolved to /etc/dashcaddy
(image-layer path), and audit/license/error logs would silently land there and
vanish on every container recreate.

1. platform-paths.assertSafe({mode:'production'}) — throws FATAL on forbidden
   zones (/app/src,routes,scripts,utils,managers,security + /etc/* + /usr + /var).
   Bypassed with SKIP_DATA_DIR_GUARD=1.
2. server.js calls assertSafe() before any runtime work.
3. start.sh one-time migration: scans 6 known image-layer zombie paths,
   copies non-empty content to bind mount with 'migrated-' prefix,
   gated by sentinel file. Survives set -e per-file failures.

19/19 platform-paths tests + 5/5 shell migration tests.
Suite: 1066/1067 (1 pre-existing public-routes-drift failure from in-flight
auth refactor, untouched by this commit).

Verified live on DNS2: live audit log at /app/data/audit-log.json (315KB,
active) is unaffected; vestigial 2-byte /app/src/security/audit-log.json +
140KB /app/src/utils/error.log (pre-DC-039 era) will be recovered on next
container recreate.

dashcaddy-api/platform-paths.js

@@ -111,4 +111,105 @@ paths.toDockerMountPath = function(hostPath) {
   return hostPath;
 };
 
+// ============================================================================
+// dataDir safety guard — DC-046 follow-up to DC-039
+// ============================================================================
+// The DC-039 fix routed every runtime-data default through `platformPaths.dataDir`
+// (derived from SERVICES_FILE → path.dirname(SERVICES_FILE)). That worked because
+// /opt/dashcaddy/dashcaddy-api/data is bind-mounted at /app/data in production.
+//
+// The silent failure mode that survived: if SERVICES_FILE isn't set as an env
+// var AND no `services.json` exists in the production bind-mount path, the
+// resolution falls back to `path.join(CADDY_BASE, 'services.json')` — and on
+// Linux that resolves to `/etc/dashcaddy/services.json` → dataDir = `/etc/dashcaddy`
+// which is the IMAGE LAYER, not a bind mount. Audit-log / error-log / license
+// files would silently land in the image and vanish on the next recreate.
+//
+// `assertSafe()` is the structural guard. Called once from server.js startup
+// in production mode (NODE_ENV=production). Throws → container refuses to boot
+// loudly, instead of running with a path that loses data silently.
+//
+// Forbidden zones (Docker image layer; recovered only by rebuild):
+//   /app/src/, /app/routes/, /app/scripts/, /app/*.js (literally /app itself
+//   when no subdir — the WORKDIR in Dockerfile is /app and a misdirected write
+//   to /app/audit-log.json would be the same problem)
+//
+// Permitted zones (bind-mounted in production, mount-relative in dev):
+//   /app/data, any non-/app or non-/etc path that resolves onto a real fs
+//
+// On non-Linux platforms, the guard only checks the Linux-style image zones.
+// Windows installs use the E:/ + C:/ ETree and never run inside the Docker image.
+
+const FORBIDDEN_DATA_DIRS = (process.platform === 'linux' && !process.env.SKIP_DATA_DIR_GUARD) ? [
+  // DC-039-era broken defaults. Hits only when SERVICES_FILE is unset AND no
+  // bind mount at /app/data resolves.
+  '/app/src',
+  '/app/routes',
+  '/app/scripts',
+  '/app/utils',
+  '/app/managers',
+  '/app/security',
+  // system dirs that should never be a dataDir
+  '/etc',
+  '/etc/caddy',
+  '/etc/dashcaddy',
+  '/usr',
+  '/usr/local',
+  '/var',
+  '/var/lib/caddy',
+] : [];
+
+paths.isMountedCheck = function(dir) {
+  // Heuristic: a "mounted" dir on Linux is reachable AND writable AND not the
+  // Docker image layer. Returning `false` lets start.sh skip migration cleanly
+  // rather than crashing.
+  if (!fs.existsSync(dir)) return false;
+  try {
+    fs.accessSync(dir, fs.constants.W_OK);
+  } catch {
+    return false;
+  }
+  // On Linux Docker, /app is a baked image layer; /app/data is bind-mounted.
+  // Detect /app without /app/data being a separate mountpoint.
+  if (process.platform === 'linux' && dir === '/app') {
+    return fs.existsSync('/app/data')
+      && fs.statSync('/app/data').dev !== fs.statSync('/app').dev;
+  }
+  return true;
+};
+
+paths.assertSafe = function({ mode = 'production' } = {}) {
+  if (mode !== 'production') return;  // dev / test pass-through
+
+  const dataDirResolved = path.resolve(paths.dataDir);
+  const norm = (p) => p.replace(/\\/g, '/').replace(/\/+$/, '');
+
+  // Zone membership is by first segment, not arbitrary substring matches.
+  // `/app/data` is allowed because `/app/data` is the bind mount; `/app/src`
+  // is forbidden because that's where the source tree lives.
+  for (const forbidden of FORBIDDEN_DATA_DIRS) {
+    if (norm(dataDirResolved) === norm(forbidden)
+        || norm(dataDirResolved).startsWith(norm(forbidden) + '/')) {
+      throw new Error(
+        `[platform-paths] FATAL: dataDir resolved to forbidden image-layer path ` +
+        `"${dataDirResolved}". This is a DC-039-class regression: runtime state would ` +
+        `be written into the Docker image and lost on next container recreate. ` +
+        `Set SERVICES_FILE=/app/data/services.json (or equivalent bind-mounted path) ` +
+        `in your container env. To bypass during local dev, set SKIP_DATA_DIR_GUARD=1.`
+      );
+    }
+  }
+
+  // Second check: dataDir should be on a writable, persistent mount.
+  if (!paths.isMountedCheck(dataDirResolved)) {
+    // Not fatal — but loud. Some Windows + dev workflows have ambiguous
+    // writability. Warn instead of throw so we don't break the install path
+    // for fresh users on Windows.
+    console.warn(
+      `[platform-paths] WARNING: dataDir "${dataDirResolved}" is not writable ` +
+      `or doesn't exist. Runtime writes may fail or land in unexpected places.`
+    );
+  }
+};
+
 module.exports = paths;