DC-003: Move stale debug test scripts to scripts/legacy/

comprehensive-test.js and test-security-fixes.js are 875 lines of
ad-hoc security test scripts (not Jest tests). They have zero references
in code or docs. Moved to scripts/legacy/ to declutter repo root
without losing the content. All 759 Jest tests still pass.

BACKLOG.md

@@ -22,17 +22,18 @@
 - **result:** Fixed root VERSION to 1.13.4. Updated `scripts/release.sh` to write both `dashcaddy-api/package.json` AND root `VERSION` on every release — also stages VERSION in the release commit. No more drift.
 
 ### DC-003: Remove stale test/debug files from repo root
-- **status:** todo
-- **owner:** 
+- **status:** done
+- **owner:** hermes
 - **details:** `comprehensive-test.js` and `test-security-fixes.js` are ad-hoc test scripts, not Jest tests. They clutter the repo root. Remove them or convert to proper Jest tests under `__tests__/`.
+- **result:** Moved both files to `dashcaddy-api/scripts/legacy/` (preserved, not deleted — they are 875 lines of security test coverage that may be useful as a manual smoke test). Zero references to them in code/docs — safe to move. All 759 Jest tests still pass.
 
 ---
 
 ## P1 — Code Quality
 
 ### DC-004: Fix 19 ESLint warnings
-- **status:** todo
-- **owner:** 
+- **status:** in-progress
+- **owner:** hermes
 - **details:** Run `cd dashcaddy-api && npx eslint src/ --format compact`. Most are unused vars and nested ternaries in `src/utils/logging.js`. Fix all, target zero warnings.
 
 ### DC-005: Organize top-level modules into src/