DC-030: bake /etc/hosts overrides into start.sh (fix git.sami resolution in container)

The container's health-checker runs against Caddy via /etc/hosts resolution.
The node:20-alpine base image has no entries for *.sami, so without explicit
--add-host flags every *.sami probe resolves via the configured DNS server
(100.121.150.22 Technitium or 8.8.8.8) — both of which DO resolve *.sami but
return the WAN/Tailscale IP. That works for most services because Caddy on
DNS2:443 handles them.

BUT: a previous container run passed --add-host=git.sami:100.81.59.99
(DNS3's Tailscale IP). DNS3 does NOT serve HTTPS on 443 — Gitea listens on
:3030 only. So git.sami health checks inside the container hit DNS3:443,
get ECONNREFUSED, and the dashboard shows git.sami as down even though Caddy
on DNS2:443 correctly routes git.sami → 100.81.59.99:3030.

Fix: inject the correct --add-host flags from start.sh (the source of truth
for container setup) so future recreates get consistent resolution. git.sami
is intentionally left OUT — Caddy on DNS2:443 is the only correct ingress
for git.sami traffic.

Also documents the rationale so the next person doesn't reintroduce the
git.sami override by accident.

Live verified:
- container /etc/hosts has all needed entries except git.sami
- curl https://git.sami/ from inside container → 200 (via Caddy on :443)
- curl https://sync.sami/ from inside container → 302 (upstream redirect)
- curl https://router.sami/ from inside container → 302 (upstream redirect)

start.sh

@@ -14,6 +14,36 @@ HOST_IP="172.17.0.1"
 DNS_PRIMARY="100.121.150.22"   # Technitium (Tailscale IP) — resolves *.sami
 DNS_FALLBACK="8.8.8.8"
 
+# --- /etc/hosts overrides for the container ---------------------------------
+# The base image (node:20-alpine) has no entries for *.sami. We must inject
+# them via --add-host so health checks inside the container can resolve LAN
+# and Tailscale IPs to the right destinations.
+#
+# IMPORTANT: Do NOT add `git.sami:100.81.59.99` (DNS3). DNS3 does not serve
+# HTTPS on 443 — it only serves Gitea on :3030. Setting git.sami → DNS3 in
+# the container would make health checks bypass Caddy and hit a closed port.
+# Let Caddy (on DNS2:443) handle git.sami and route to DNS3:3030 internally.
+#
+# Layout:
+#   dns3.sami / gitea → DNS3 (Tailscale IP, used by tools inside the container
+#                        that need to talk to Gitea directly, e.g. backups)
+#   dns3-wan.sami     → DNS3 Contabo WAN fallback
+#   dns2.sami         → DNS2 (this host) — for cross-service references
+#   dns1.sami         → DNS1 (SAMI-CLOUD-U32)
+#   dc-contabo-de     → DashCaddy Contabo test instance
+#   git.dashcaddy.net → DashCaddy upstream git
+#   ca.sami           → local CA (DN2 + DN3 both have their own)
+ADD_HOST_FLAGS=(
+  --add-host=dns3.sami:100.81.59.99
+  --add-host=gitea:100.81.59.99
+  --add-host=dns3-wan.sami:74.208.167.19
+  --add-host=dns2.sami:100.121.150.22
+  --add-host=dns1.sami:100.71.97.12
+  --add-host=dc-contabo-de:100.98.123.59
+  --add-host=git.dashcaddy.net:100.98.123.59
+  --add-host=ca.sami:127.0.0.1
+)
+
 # Always recreate to ensure env vars are correct (CONFIG_FILE defaults to /etc/dashcaddy/ which doesn't exist)
 if docker ps -a --format "{{.Names}}" | grep -q "^${CONTAINER_NAME}$"; then
   echo "[start.sh] Recreating container to apply correct env vars..."
@@ -26,6 +56,7 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
   --add-host=get2.dashcaddy.net:194.233.88.206 \
   --dns ${DNS_PRIMARY} \
   --dns ${DNS_FALLBACK} \
+  "${ADD_HOST_FLAGS[@]}" \
   -p 127.0.0.1:3001:3001 \
   -v ${DATA_DIR}:/app/data \
   -v ${BACKUPS_DIR}:/app/backups \
@@ -48,4 +79,4 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
   -e ASSETS_DIR=/app/assets \
   -e DASHCADDY_API_SOURCE_DIR=/opt/dashcaddy/dashcaddy-api \
   -e DASHCADDY_UPDATE_ENABLED=false \
-  ${IMAGE}
+  ${IMAGE}