DC-023: operational fixes — DNS, rate limiter, version sync

- VERSION: bump from 1.14.4 to 1.14.6 to match package.json (HEAD had stale value)
- middleware.js: apply existing totpLimiter (10/15min) to /totp/setup endpoint
  (was previously unmetered, allowing secret enumeration)
- dashcaddy-update.sh: hook post-deploy-patches.sh into the update flow
  so the container can survive transitions between broken → fixed tarballs
- start.sh: add --add-host flags for get.dashcaddy.net and get2.dashcaddy.net
  so the container can resolve the release server (was failing with ENOTFOUND)

start.sh

@@ -22,6 +22,8 @@ fi
 
 echo "[start.sh] Creating container with full config..."
 docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
+  --add-host=get.dashcaddy.net:194.233.88.206 \
+  --add-host=get2.dashcaddy.net:194.233.88.206 \
   --dns ${DNS_PRIMARY} \
   --dns ${DNS_FALLBACK} \
   -p 127.0.0.1:3001:3001 \