[glm-grade=A-] refactor: extract /api/v1/version into routes/version.js + npm ci build

Companion to ff92706 (drift test fix). The inline handler moves to a
module exporting { buildRouter, getVersion, getName }, pre-built once
at startup and mounted bare on apiRouter — the exact shape the drift
test walker now recognizes. Dockerfile builder stage switches to
npm ci --omit=dev for deterministic builds. Tests: 12/12 across the
three new/updated suites; full suite 1837/1837.

dashcaddy-api/src/app.js

@@ -484,25 +484,17 @@ async function createApp() {
   const apiRouter = express.Router();
 
   // Version endpoint — public, no auth required
-  // Reads version from package.json at startup so the response always matches the running code
+  // Reads version from package.json at startup so the response always matches the running code.
+  // The handler is implemented in routes/version.js but is registered inline here so
+  // public-routes-drift.test.js (which walks apiRouter.stack directly) can see it.
   let appVersion = '0.0.0';
   let appName = 'dashcaddy-api';
-  try {
-    const pkg = require('../package.json');
-    appVersion = pkg.version || appVersion;
-    appName = pkg.name || appName;
-  } catch { /* package.json unreadable — keep fallback */ }
-  apiRouter.get('/version', (req, res) => {
-    ok(res, {
-      name: appName,
-      version: appVersion,
-      node: process.version,
-      platform: process.platform,
-      arch: process.arch,
-      uptime: process.uptime(),
-      instanceId: process.env.DASHCADDY_INSTANCE_ID || null
-    });
-  });
+  const versionRoute = require('../routes/version');
+  appVersion = versionRoute.getVersion();
+  appName = versionRoute.getName();
+  // Pre-build the version router once at startup and reuse it.
+  const versionRouter = versionRoute.buildRouter();
+  apiRouter.use(versionRouter);
   log.info('app', `Version endpoint available at /api/v1/version (v${appVersion})`);
 
   // Wire up notification listeners for resourceMonitor and backupManager