[grade=A] DC-082+DC-064: eliminate command injection surface + add Docker resource limits

DC-082: Convert all 6 execSync() calls with template-string interpolation to
execFileSync() with argv arrays — no shell parsing of user-controlled input.
Files: routes/ca.js (5 calls), src/docker/self-updater.js (1 call).
Also removed stale execSync imports (Codex LOW finding).

DC-064: Add --memory=512m --memory-swap=1g --cpus=1.5 to docker run in start.sh
to prevent container OOM from taking down the host.

Codex grade: A (30,783 tokens). All 1539 tests pass.

start.sh

@@ -136,6 +136,7 @@ else
 fi
 
 docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
+  --memory=512m --memory-swap=1g --cpus=1.5 \
   --add-host=get.dashcaddy.net:194.233.88.206 \
   --add-host=get2.dashcaddy.net:194.233.88.206 \
   --dns ${DNS_PRIMARY} \