[grade=B] docs+cleanup: fix BUILD_GUIDE factual errors, document wine/i386 NSIS pitfall, drop .bak junk

BUILD_GUIDE.md wrongly said output goes to dist/ (actual: build-output),
mac builds produce .dmg (actual target: zip), and cited a nonexistent
win-unpacked portable path. Corrected to the verified config truth and
added the wine64+wine32:i386 cross-build requirement discovered today:
without wine32 the NSIS setup exe ships as a 211KB payload-less stub
while electron-builder exits 0. Documented the authoritative 7z payload
check + post-build secrets scan. Round1 judge B+5 polish, folded:
version placeholders, heuristic-vs-authoritative wording, distro/sudo
notes, mac zip wording. Judge: qwen3.8-max stand-in lane.
Also removes package.json.bak and index.js.bak (stale junk).

dashcaddy-installer/BUILD_GUIDE.md

@@ -67,11 +67,48 @@ npm run build:linux
 
 ### Build Output
 
-Built applications are placed in the `dist/` directory:
+Built applications are placed in the `build-output/` directory:
 
-- **Windows**: `dist/win-unpacked/DashCaddy Installer.exe` (portable)
-- **macOS**: `dist/DashCaddy Installer.dmg`
-- **Linux**: `dist/DashCaddy Installer.AppImage` and `.deb`
+- **Windows**: `build-output/DashCaddy Installer <version>.exe` (portable) and
+  `build-output/DashCaddy Installer Setup <version>.exe` (NSIS installer)
+  — filenames embed the current `version` from package.json
+- **macOS**: `build-output/DashCaddy Installer-<version>-mac.zip` — the
+  configured mac target is `zip` (unsigned; signed `.dmg` builds require
+  a Mac with signing credentials)
+- **Linux**: `build-output/DashCaddy Installer-<version>.AppImage` and
+  `build-output/dashcaddy-installer_<version>_amd64.deb`
+
+### Cross-platform build requirements (verified 2026-09-01)
+
+Building Windows installers from Linux requires **wine with both 64-bit and
+32-bit support** — NSIS's 32-bit post-processing runs under wine:
+
+```bash
+# Ubuntu 24.04 (Debian/Ubuntu package names; other distros vary).
+# Requires root / sudo for the dpkg and apt steps.
+dpkg --add-architecture i386
+# add i386 mirror entries if the main sources are amd64-only pinned
+apt-get update && apt-get install -y wine64 wine32:i386
+# initialize a prefix once (avoids kernel32.dll load failures in CI)
+export WINEPREFIX=~/.wine-dashcaddy && wineboot --init
+```
+
+Without wine32, the NSIS setup exe is built but ends up as a ~211KB stub
+(payload not appended) and the build appears to pass (exit 0). Check the
+result — the size (~90MB+) is a quick heuristic, but the **authoritative**
+check is listing/extracting the payload:
+
+```bash
+7z l "build-output/DashCaddy Installer Setup <version>.exe"   # should list a large app-64.7z
+# or extract and scan: 7z x <setup.exe> && 7z x '$PLUGINSDIR/app-64.7z'
+```
+
+After every build, run the secrets scanner to verify no private key material
+was bundled into the shipped resources:
+
+```bash
+npm run build:scan
+```
 
 ## Project Structure