DC-023: operational fixes — DNS, rate limiter, version sync

- VERSION: bump from 1.14.4 to 1.14.6 to match package.json (HEAD had stale value)
- middleware.js: apply existing totpLimiter (10/15min) to /totp/setup endpoint
  (was previously unmetered, allowing secret enumeration)
- dashcaddy-update.sh: hook post-deploy-patches.sh into the update flow
  so the container can survive transitions between broken → fixed tarballs
- start.sh: add --add-host flags for get.dashcaddy.net and get2.dashcaddy.net
  so the container can resolve the release server (was failing with ENOTFOUND)

scripts/dashcaddy-update.sh

@@ -306,6 +306,21 @@ main() {
     echo "$commit" > "$api_source_dir/VERSION"
   fi
 
+  # 3a. Apply post-deploy patches — fix upstream bugs in released tarballs
+  # (e.g. v1.14.4 has broken require paths and missing license-keygen module).
+  # Runs AFTER staging copy, BEFORE docker build. Idempotent.
+  local patch_script="/opt/dashcaddy/scripts/dashcaddy-post-deploy-patches.sh"
+  if [[ -x "$patch_script" ]]; then
+    log "Applying post-deploy patches..."
+    if "$patch_script" "$api_source_dir"; then
+      log "Post-deploy patches applied successfully"
+    else
+      log "WARNING: Post-deploy patches exited non-zero — continuing build anyway"
+    fi
+  else
+    log "NOTE: $patch_script not found or not executable — skipping post-deploy patches"
+  fi
+
   # 3b. Sync frontend
   if [[ -z "$frontend_staging_dir" ]]; then
     parent_staging=$(dirname "$staging_dir")