Add Security Center — multi-source event pipeline with dashboard UI

Introduces a unified security event store and HTTP API that ingests events
from any of the configured sources (API audit, Caddy access log, fail2ban,
shared_bans, future remote agents) and surfaces them in the dashboard.

New files:
  src/security/event-store.js      JSONL-backed store + in-memory query index
  src/security/host-registry.js    Registered hosts with per-host API keys
  src/security/event-workers.js    Tail-followers for Caddy/fail2ban/shared_bans logs
  routes/security.js               Events, hosts, ingest, SSE stream endpoints
  status/js/security-center.js     Dashboard modal with Overview/Events/Hosts tabs
  SECURITY-FEATURE.md              Full feature documentation
  DEAD-CODE.md, DUP-CODE.md, HARDENING.md   Prior audits

Modified:
  src/app.js                       Mount /api/v1/security/*
  src/utilities/middleware.js      Add ingest endpoints to PUBLIC_ROUTES
  src/security/audit-logger.js     Mirror audit events into security store
  server.js                        Start security workers on boot
  status/build.js                  Bundle security-center.js
  status/index.html                Add Security button to nav

dashcaddy-api/src/utilities/middleware.js

@@ -361,6 +361,11 @@ module.exports = function configureMiddleware(app, {
       { path: '/api/v1/health-checks/status', exact: true, method: 'GET' },
     ] : []),
     { path: '/api/v1/version',             exact: true, method: 'GET' },
+    // Security ingest endpoints — auth via per-host Bearer token (handled in routes/security.js),
+    // NOT via TOTP/JWT. This lets remote DashCaddy agents and log parsers push events
+    // without needing a TOTP session.
+    { path: '/api/v1/security/events/ingest', exact: true, method: 'POST' },
+    { path: '/api/v1/security/events/batch',  exact: true, method: 'POST' },
   ];
 
   function isPublicRoute(req) {