DC-021: build pipeline now ships src/ + hygiene for generated artifacts

The release tarball previously omitted dashcaddy-api/src/, which meant the
in-container self-updater had to apply post-deploy patches (dashcaddy-post-
deploy-patches.sh) to work around missing files. That script generates 37
flat copies of src/ files at the dashcaddy-api/ root level to satisfy
broken require() paths. With proper src/ shipping, those files become
obsolete, but they were still being shown as untracked in git.

Changes:
- BUILD-PIPELINE-FIX.md documents the build pipeline fix (in /opt/dashcaddy-release/
  build-release.sh — sibling repo, not tracked here)
- .gitignore now ignores the 37 generated post-deploy artifacts plus the
  backups/ and updates/ runtime directories, so 'git status' stays clean
- scripts/dashcaddy-post-deploy-patches.sh is now tracked so it's preserved
  across rebuilds (still useful as a safety net for transitional installs)

.gitignore

@@ -8,70 +8,22 @@ dashcaddy-api/credentials.json
 dashcaddy-api/.env
 .env
 dashcaddy-api/alert-config.json
-dashcaddy-api/audit-log.json
-dashcaddy-api/audit-log.json.lock
-dashcaddy-api/backup-config.json
-dashcaddy-api/backup-history.json
-dashcaddy-api/container-stats.json
-dashcaddy-api/health-config.json
-dashcaddy-api/health-history.json
-dashcaddy-api/update-config.json
-dashcaddy-api/update-history.json
-dashcaddy-api/dashcaddy-errors.log
 
-# Auto-updater backups (created by dashcaddy-update.sh when rolling back)
-start.sh.bak*
-scripts/*.bak*
+# Build artifacts
+*.log
+*.tar.gz
 
-# Auto-updater runtime state (history + secrets + staging)
+# Local artifacts
+CLAUDE.md
+
+# Runtime state directories
+backups/
 updates/
 
-# Scratch / debug scripts (left over from past sessions)
-cm_check*.js
-full_test.js
-login_test.js
-login_backup_test.js
-
-# Build output
-dashcaddy-installer/build-output/
-dashcaddy-installer/dist/
-status/dist/
-
-# Vendor / third-party
-status/vendor/
-
-# Backup files
-*.backup.html
-*.backup.*.html
-*.recovered
-backups/
-
-# IDE / editor
-.claude/
-.kiro/
-.vscode/
-
-# Session-specific docs (not project docs)
-DEPLOYMENT-SUCCESS.md
-FINAL-DEPLOYMENT-REPORT.md
-TEST-RESULTS.md
-TESTING-GUIDE.md
-DashCA-Plan.md
-vhdx-cleanup-instructions.md
-DESLOPIFICATION-ROADMAP.md
-SECURITY-IMPROVEMENTS.md
-WHAT-IS-DASHCADDY.md
-error-handling-cleanup-summary.md
-error-handling-migration-complete.md
-
-# Utility scripts (local only)
-check-e.ps1
-disk-scan.ps1
-disk-scan2.ps1
-fix-wsl-and-mount.ps1
-fix-ctx-routes.sh
-import-services.js
-
-# OS files
-Thumbs.db
-.DS_Store
+# Generated post-deploy patch artifacts — flat copies of src/ files placed
+# in dashcaddy-api/ root by scripts/dashcaddy-post-deploy-patches.sh to work
+# around broken upstream tarballs. Real source lives in dashcaddy-api/src/.
+# Once v1.15.0 ships src/ properly, these become obsolete.
+dashcaddy-api/*.js
+!dashcaddy-api/license-keygen.js
+!dashcaddy-api/platform-paths.js