[glm-grade=B] fix: dead dashboard WS, corrupted error.log, auth-polling storm, re-auth freeze + CVE bumps

Adversarial audit 2026-08-16 (GLM-5.3 delegate, 2 rounds, 141 tool calls):

P0-1: Dashboard WebSocket (/api/v1/ws) dead on EVERY boot since DC-076.
server.js passed module exports (DependencyManager class, {AutoRestartManager}
namespace, SSLMonitor class) instead of createApp()'s live instances — first
.on() threw ERR_INVALID_ARG_TYPE, catch swallowed it. Fix: app.locals.ctx
exposed in src/app.js; server.js passes all 8 real EventEmitter instances.

P0-2: error.log corrupted since 2026-07-14. errorMiddleware called
logError(FILE, SIZE, path, err, meta) — 5 args into a 3-arg wrapper —
logging 'Error: 5242880' garbage every ~60s and DISCARDING the real error
object. Fix: correct 3-arg call + legacy-shape guard in logErrorWrapper +
~74 log.error sites swept to pass real error objects (AST-verified scope-
safe 71/71, 29/29 modules load clean).

P0-3: auth-polling storm (stranded grade=B commit never landed in prod):
401/403 behind TOTP gate hammered /api/v1/services/status + SSE reconnect
every 2-8s, with misleading direct-probe fallback marking services 'up'.
Fix landed + B-round MEDIUM follow-up: TOTP re-auth success now clears
_dcAuthLost, resumes SSE (new _sseResume clears the latch), and refreshes.

Also: eslintignore static-sites/ (33→0 errors); nodemailer 8→9.0.5 and
sharp 0.33→0.35.3 (3 high CVEs killed; jest green on new majors);
dockerode@5/uuid deferred (semver-major, Docker API surface).

Verification: 80/80 suites, 1837/1837 tests; ESLint 0 errors/743 warnings;
node --check all changed files; bundles rebuilt + SW cache bumped.

Judges: Codex quota-dead until Aug 19 (verified live) — GLM adversarial
delegate per operator directive 2026-08-07. Round 1: 98-call mechanical
verification (timed out pre-verdict). Round 2 (this grade): B, one MEDIUM
(re-auth freeze) — fixed in this commit as prescribed.

dashcaddy-api/src/monitoring/ssl-monitor.js

@@ -143,7 +143,7 @@ class SSLMonitor extends EventEmitter {
     try {
       servicesData = await this.ctx.servicesStateManager.read();
     } catch (err) {
-      this.log.error('ssl-monitor', 'Failed to read services', { error: err.message });
+      this.log.error('ssl-monitor', err, null, { note: 'Failed to read services' });
       return this.getStatus();
     }
 
@@ -212,13 +212,13 @@ class SSLMonitor extends EventEmitter {
 
     // Initial check (non-blocking)
     this.checkAll().catch(err => {
-      this.log.error('ssl-monitor', 'Initial SSL check failed', { error: err.message });
+      this.log.error('ssl-monitor', err, null, { note: 'Initial SSL check failed' });
     });
 
     // Schedule periodic checks
     this.intervalHandle = setInterval(() => {
       this.checkAll().catch(err => {
-        this.log.error('ssl-monitor', 'Periodic SSL check failed', { error: err.message });
+        this.log.error('ssl-monitor', err, null, { note: 'Periodic SSL check failed' });
       });
     }, this.config.intervalMs);
 
@@ -299,7 +299,7 @@ class SSLMonitor extends EventEmitter {
         clearInterval(this.intervalHandle);
         this.intervalHandle = setInterval(() => {
           this.checkAll().catch(err => {
-            this.log.error('ssl-monitor', 'Periodic SSL check failed', { error: err.message });
+            this.log.error('ssl-monitor', err, null, { note: 'Periodic SSL check failed' });
           });
         }, this.config.intervalMs);
       }
@@ -355,7 +355,7 @@ class SSLMonitor extends EventEmitter {
             validTo: certResult.validTo
           }, level <= THRESHOLDS.CRITICAL ? 'error' : 'warning');
         } catch (err) {
-          this.log.error('ssl-monitor', 'Failed to send SSL notification', { error: err.message });
+          this.log.error('ssl-monitor', err, null, { note: 'Failed to send SSL notification' });
         }
       }
     } else if (level === null) {