DC-053: Public share links + Tailscale-mediated share (Pro-gated)

- Share-store: HMAC-signed tokens bound to serviceId+kind, persistent
  signing secret in dataDir/.share-secret, atomic writes, auto-prune
- Routes: admin endpoints gated on licenseManager.isPro() (402 Free);
  public endpoints CSRF-exempt (token IS proof)
- Tailscale path: mints single-use ephemeral pre-auth key, emails
  join link, rolls back share record if createAuthKey throws
- Email-failure path: exposes urlPath for manual delivery fallback
- 53 new tests (24 store + 29 routes), full suite 1372/1372
- Drift-test parser hardened against quoted-word comments
- share-store dataDir resolver handles Proxy/function values

CHANGELOG + BACKLOG updated.

dashcaddy-api/src/utilities/middleware.js

@@ -340,6 +340,11 @@ module.exports = function configureMiddleware(app, {
     // UI can show "this invite is for X, expires Y" before clicking.
     { path: '/api/v1/auth/invites/:token',            exact: true,  method: 'GET' },
     { path: '/api/v1/auth/invites/:token/accept',     exact: true,  method: 'POST' },
+    // DC-053: share-link redemption is PUBLIC — visitors arrive via email
+    // or social share with no DashCaddy session. The token IS the proof.
+    { path: '/api/v1/share/:token/preview',           exact: true,  method: 'GET' },
+    { path: '/api/v1/share/:token/subscribe',         exact: true,  method: 'POST' },
+    { path: '/api/v1/share/:token/redeem-tailscale',  exact: true,  method: 'POST' },
     // /me and /admin/* require authentication — NOT public. Listed here
     // only to document them; absence from PUBLIC_ROUTES means they go
     // through the normal auth gate. CSRF applies to writes as usual.