[glm-grade=A-] refactor: extract /api/v1/version into routes/version.js + npm ci build

Companion to ff92706 (drift test fix). The inline handler moves to a
module exporting { buildRouter, getVersion, getName }, pre-built once
at startup and mounted bare on apiRouter — the exact shape the drift
test walker now recognizes. Dockerfile builder stage switches to
npm ci --omit=dev for deterministic builds. Tests: 12/12 across the
three new/updated suites; full suite 1837/1837.

dashcaddy-api/__tests__/routes/version-http.test.js

@@ -0,0 +1,48 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const express = require('express');
+const request = require('supertest');
+
+// This test mounts the EXACT version route module that production wires into
+// apiRouter via require('../routes/version') in src/app.js. There is no
+// duplicated handler — both production and this test resolve the same module.
+
+describe('HTTP /api/v1/version route contract (real production module)', () => {
+  let app;
+  let versionModule;
+
+  beforeAll(() => {
+    app = express();
+    versionModule = require('../../routes/version');
+    app.use('/api/v1', versionModule.buildRouter());
+  });
+
+  it('returns package semver via the real version route module', async () => {
+    const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'package.json'), 'utf8'));
+    const res = await request(app).get('/api/v1/version');
+    expect(res.status).toBe(200);
+    expect(res.body.success).toBe(true);
+    expect(res.body.version).toBe(pkg.version);
+    expect(res.body.version).toMatch(/^\d+\.\d+\.\d+$/);
+    expect(res.body.name).toBe('dashcaddy-api');
+    expect(res.body.node).toMatch(/^v\d+/);
+    expect(res.body.platform).toBe(process.platform);
+    expect(res.body.arch).toBe(process.arch);
+    expect(typeof res.body.uptime).toBe('number');
+  });
+
+  it('version module exports getVersion/getName/buildRouter', () => {
+    expect(typeof versionModule.getVersion).toBe('function');
+    expect(typeof versionModule.getName).toBe('function');
+    expect(typeof versionModule.buildRouter).toBe('function');
+    expect(versionModule.getVersion()).toMatch(/^\d+\.\d+\.\d+$/);
+  });
+
+  it('src/app.js wires routes/version.js into the apiRouter', () => {
+    const appSource = fs.readFileSync(path.join(__dirname, '..', '..', 'src', 'app.js'), 'utf8');
+    expect(appSource).toMatch(/require\(['"]\.\.\/routes\/version['"]\)/);
+    expect(appSource).toMatch(/versionRoute\.buildRouter\(\)/);
+  });
+});

dashcaddy-api/__tests__/version-image-contract.test.js

@@ -0,0 +1,31 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const apiRoot = path.join(__dirname, '..');
+
+describe('production version contract', () => {
+  test('package semver is the source reported by the public version route', () => {
+    const pkg = JSON.parse(fs.readFileSync(path.join(apiRoot, 'package.json'), 'utf8'));
+    const app = fs.readFileSync(path.join(apiRoot, 'src', 'app.js'), 'utf8');
+    expect(pkg.version).toMatch(/^\d+\.\d+\.\d+$/);
+    // The version route is now extracted to routes/version.js and wired in.
+    expect(app).toMatch(/require\(['"]\.\.\/routes\/version['"]\)/);
+    expect(app).toMatch(/versionRoute\.buildRouter\(\)/);
+  });
+
+  test('production Docker image copies the manifest read by the route', () => {
+    const dockerfile = fs.readFileSync(path.join(apiRoot, 'Dockerfile'), 'utf8');
+    expect(dockerfile).toMatch(/^COPY package\.json \.\/$/m);
+    expect(dockerfile).toMatch(/^RUN npm ci --omit=dev$/m);
+    expect(dockerfile).not.toMatch(/^RUN npm install$/m);
+    expect(dockerfile).toMatch(/^COPY src\/ \.\/src\/$/m);
+  });
+
+  test('routes/version.js exports the production route module', () => {
+    const versionRoute = require('../routes/version');
+    expect(typeof versionRoute.buildRouter).toBe('function');
+    expect(versionRoute.getVersion()).toMatch(/^\d+\.\d+\.\d+$/);
+  });
+});