DC-023: operational fixes — DNS, rate limiter, version sync

- VERSION: bump from 1.14.4 to 1.14.6 to match package.json (HEAD had stale value)
- middleware.js: apply existing totpLimiter (10/15min) to /totp/setup endpoint
  (was previously unmetered, allowing secret enumeration)
- dashcaddy-update.sh: hook post-deploy-patches.sh into the update flow
  so the container can survive transitions between broken → fixed tarballs
- start.sh: add --add-host flags for get.dashcaddy.net and get2.dashcaddy.net
  so the container can resolve the release server (was failing with ENOTFOUND)

VERSION

@@ -1 +1 @@
-1.14.4
+1.14.6

dashcaddy-api/src/utilities/middleware.js

@@ -473,6 +473,11 @@ module.exports = function configureMiddleware(app, {
   });
   app.use('/api/v1/totp/verify', totpLimiter);
   app.use('/api/v1/totp/verify-setup', totpLimiter);
+  // /totp/setup was previously unmetered — an attacker could enumerate
+  // secrets or DoS the QR generator. Apply the same 10/15min limit as the
+  // other TOTP endpoints. The standardHeaders config above emits
+  // RateLimit-Limit / RateLimit-Remaining for clients to see.
+  app.use('/api/v1/totp/setup', totpLimiter);
 
   // ── Audit logging middleware (logs non-GET API requests) ──
   app.use(auditLogger.middleware());

scripts/dashcaddy-update.sh

@@ -306,6 +306,21 @@ main() {
     echo "$commit" > "$api_source_dir/VERSION"
   fi
 
+  # 3a. Apply post-deploy patches — fix upstream bugs in released tarballs
+  # (e.g. v1.14.4 has broken require paths and missing license-keygen module).
+  # Runs AFTER staging copy, BEFORE docker build. Idempotent.
+  local patch_script="/opt/dashcaddy/scripts/dashcaddy-post-deploy-patches.sh"
+  if [[ -x "$patch_script" ]]; then
+    log "Applying post-deploy patches..."
+    if "$patch_script" "$api_source_dir"; then
+      log "Post-deploy patches applied successfully"
+    else
+      log "WARNING: Post-deploy patches exited non-zero — continuing build anyway"
+    fi
+  else
+    log "NOTE: $patch_script not found or not executable — skipping post-deploy patches"
+  fi
+
   # 3b. Sync frontend
   if [[ -z "$frontend_staging_dir" ]]; then
     parent_staging=$(dirname "$staging_dir")

start.sh

@@ -22,6 +22,8 @@ fi
 
 echo "[start.sh] Creating container with full config..."
 docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
+  --add-host=get.dashcaddy.net:194.233.88.206 \
+  --add-host=get2.dashcaddy.net:194.233.88.206 \
   --dns ${DNS_PRIMARY} \
   --dns ${DNS_FALLBACK} \
   -p 127.0.0.1:3001:3001 \