Add Security Center — multi-source event pipeline with dashboard UI

Introduces a unified security event store and HTTP API that ingests events
from any of the configured sources (API audit, Caddy access log, fail2ban,
shared_bans, future remote agents) and surfaces them in the dashboard.

New files:
  src/security/event-store.js      JSONL-backed store + in-memory query index
  src/security/host-registry.js    Registered hosts with per-host API keys
  src/security/event-workers.js    Tail-followers for Caddy/fail2ban/shared_bans logs
  routes/security.js               Events, hosts, ingest, SSE stream endpoints
  status/js/security-center.js     Dashboard modal with Overview/Events/Hosts tabs
  SECURITY-FEATURE.md              Full feature documentation
  DEAD-CODE.md, DUP-CODE.md, HARDENING.md   Prior audits

Modified:
  src/app.js                       Mount /api/v1/security/*
  src/utilities/middleware.js      Add ingest endpoints to PUBLIC_ROUTES
  src/security/audit-logger.js     Mirror audit events into security store
  server.js                        Start security workers on boot
  status/build.js                  Bundle security-center.js
  status/index.html                Add Security button to nav

dashcaddy-api/server.js

@@ -134,6 +134,17 @@ process.on('uncaughtException', (error) => {
         log.error('server', 'Backup manager failed to start', { error: err.message });
       }
 
+      // Security event workers (Caddy access log, fail2ban, shared_bans)
+      // Each one tail-follows a log file and emits events into the unified
+      // security store. They survive restarts via persisted offsets.
+      try {
+        const { startAll: startSecurityWorkers } = require('./src/security/event-workers');
+        startSecurityWorkers({ log });
+        log.info('server', 'Security event workers started');
+      } catch (err) {
+        log.error('server', 'Security event workers failed to start', { error: err.message });
+      }
+
       // Connect workflow engine to update manager for pre-update events
       if (workflowEngine) {
         updateManager.setWorkflowEngine(workflowEngine);