fix: prevent encryption key conflicts and add license backup

- Remove eager key generation from crypto-utils module load (was baking
  keys into Docker images that conflicted with mounted production keys)
- Add license backup to config.json (survives credential store failures)
- LicenseManager.load() falls back to config.json backup if credential
  store decryption fails (e.g. after container rebuild with new key)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dashcaddy-api/crypto-utils.js

@@ -312,8 +312,9 @@ function decryptWithKey(encryptedData, key) {
   return decrypted;
 }
 
-// Initialize key on module load
-loadOrCreateKey();
+// Lazy-initialize: key is loaded on first encrypt/decrypt call.
+// Do NOT call loadOrCreateKey() here — during Docker build, it would generate
+// a key baked into the image that conflicts with the mounted production key.
 
 /**
  * Clear the cached encryption key so it reloads from file on next use.