[glm-grade=A-] refactor: extract /api/v1/version into routes/version.js + npm ci build

Companion to ff92706 (drift test fix). The inline handler moves to a
module exporting { buildRouter, getVersion, getName }, pre-built once
at startup and mounted bare on apiRouter — the exact shape the drift
test walker now recognizes. Dockerfile builder stage switches to
npm ci --omit=dev for deterministic builds. Tests: 12/12 across the
three new/updated suites; full suite 1837/1837.

dashcaddy-api/__tests__/version-image-contract.test.js

@@ -0,0 +1,31 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const apiRoot = path.join(__dirname, '..');
+
+describe('production version contract', () => {
+  test('package semver is the source reported by the public version route', () => {
+    const pkg = JSON.parse(fs.readFileSync(path.join(apiRoot, 'package.json'), 'utf8'));
+    const app = fs.readFileSync(path.join(apiRoot, 'src', 'app.js'), 'utf8');
+    expect(pkg.version).toMatch(/^\d+\.\d+\.\d+$/);
+    // The version route is now extracted to routes/version.js and wired in.
+    expect(app).toMatch(/require\(['"]\.\.\/routes\/version['"]\)/);
+    expect(app).toMatch(/versionRoute\.buildRouter\(\)/);
+  });
+
+  test('production Docker image copies the manifest read by the route', () => {
+    const dockerfile = fs.readFileSync(path.join(apiRoot, 'Dockerfile'), 'utf8');
+    expect(dockerfile).toMatch(/^COPY package\.json \.\/$/m);
+    expect(dockerfile).toMatch(/^RUN npm ci --omit=dev$/m);
+    expect(dockerfile).not.toMatch(/^RUN npm install$/m);
+    expect(dockerfile).toMatch(/^COPY src\/ \.\/src\/$/m);
+  });
+
+  test('routes/version.js exports the production route module', () => {
+    const versionRoute = require('../routes/version');
+    expect(typeof versionRoute.buildRouter).toBe('function');
+    expect(versionRoute.getVersion()).toMatch(/^\d+\.\d+\.\d+$/);
+  });
+});