test: build comprehensive test suite reaching 80%+ coverage threshold

Add 22 test files (~700 tests) covering security-critical modules, core
infrastructure, API routes, and error handling. Final coverage: 86.73%
statements / 80.57% branches / 85.57% functions / 87.42% lines, all above
the 80% threshold enforced by jest.config.js.

Highlights:
- Unit tests for crypto-utils, credential-manager, auth-manager, csrf,
  input-validator, state-manager, health-checker, backup-manager,
  update-manager, resource-monitor, app-templates, platform-paths,
  port-lock-manager, errors, error-handler, pagination, url-resolver
- Route tests for health, services, and containers (supertest + mocked deps)
- Shared test-utils helper for mock factories and Express app builder
- npm scripts for CI: test:ci, test:unit, test:routes, test:security,
  test:changed, test:debug
- jest.config.js: expand coverage targets, add 80% threshold gate
- routes/services.js: import ValidationError and NotFoundError from errors
- .gitignore: exclude coverage/, *.bak, *.log

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dashcaddy-api/__tests__/platform-paths.test.js

@@ -0,0 +1,133 @@
+describe('Platform Paths — cross-platform path resolution', () => {
+  const originalPlatform = process.platform;
+  const originalEnv = { ...process.env };
+
+  afterEach(() => {
+    // Restore env
+    process.env = { ...originalEnv };
+    jest.resetModules();
+  });
+
+  function loadPaths() {
+    return require('../platform-paths');
+  }
+
+  describe('default paths on current platform', () => {
+    it('exports all required path properties', () => {
+      const paths = loadPaths();
+      expect(paths).toHaveProperty('caddyBase');
+      expect(paths).toHaveProperty('caddySites');
+      expect(paths).toHaveProperty('dockerData');
+      expect(paths).toHaveProperty('caddyfile');
+      expect(paths).toHaveProperty('caddyAdminUrl');
+      expect(paths).toHaveProperty('servicesFile');
+      expect(paths).toHaveProperty('configFile');
+      expect(paths).toHaveProperty('dnsCredentialsFile');
+      expect(paths).toHaveProperty('caCertDir');
+      expect(paths).toHaveProperty('pkiRootCert');
+      expect(paths).toHaveProperty('sitePath');
+      expect(paths).toHaveProperty('appData');
+      expect(paths).toHaveProperty('isWindows');
+      expect(paths).toHaveProperty('isLinux');
+    });
+
+    it('sitePath returns path under caddySites', () => {
+      const paths = loadPaths();
+      const result = paths.sitePath('plex');
+      expect(result).toContain('plex');
+      const norm = p => p.replace(/\\/g, '/');
+      expect(norm(result)).toContain(norm(paths.caddySites));
+    });
+
+    it('appData returns path under dockerData', () => {
+      const paths = loadPaths();
+      const result = paths.appData('radarr');
+      expect(result).toContain('radarr');
+      const norm = p => p.replace(/\\/g, '/');
+      expect(norm(result)).toContain(norm(paths.dockerData));
+    });
+  });
+
+  describe('environment variable overrides', () => {
+    it('CADDY_BASE overrides caddyBase', () => {
+      process.env.CADDY_BASE = '/custom/caddy';
+      const paths = loadPaths();
+      expect(paths.caddyBase).toBe('/custom/caddy');
+    });
+
+    it('DOCKER_DATA overrides dockerData', () => {
+      process.env.DOCKER_DATA = '/custom/docker';
+      const paths = loadPaths();
+      expect(paths.dockerData).toBe('/custom/docker');
+    });
+
+    it('CADDYFILE_PATH overrides caddyfile', () => {
+      process.env.CADDYFILE_PATH = '/custom/Caddyfile';
+      const paths = loadPaths();
+      expect(paths.caddyfile).toBe('/custom/Caddyfile');
+    });
+
+    it('CADDY_ADMIN_URL overrides caddyAdminUrl', () => {
+      process.env.CADDY_ADMIN_URL = 'http://custom:9999';
+      const paths = loadPaths();
+      expect(paths.caddyAdminUrl).toBe('http://custom:9999');
+    });
+
+    it('SERVICES_FILE overrides servicesFile', () => {
+      process.env.SERVICES_FILE = '/custom/services.json';
+      const paths = loadPaths();
+      expect(paths.servicesFile).toBe('/custom/services.json');
+    });
+  });
+
+  describe('toDockerMountPath', () => {
+    it('passes through Unix paths unchanged', () => {
+      const paths = loadPaths();
+      if (!paths.isWindows) {
+        expect(paths.toDockerMountPath('/opt/dockerdata/plex')).toBe('/opt/dockerdata/plex');
+      }
+    });
+
+    if (process.platform === 'win32') {
+      it('converts Windows drive paths to Docker mount format', () => {
+        const paths = loadPaths();
+        expect(paths.toDockerMountPath('C:/caddy/Caddyfile')).toBe('//mnt/host/c/caddy/Caddyfile');
+        expect(paths.toDockerMountPath('E:/dockerdata/plex')).toBe('//mnt/host/e/dockerdata/plex');
+      });
+
+      it('converts backslash paths', () => {
+        const paths = loadPaths();
+        expect(paths.toDockerMountPath('C:\\caddy\\Caddyfile')).toBe('//mnt/host/c/caddy/Caddyfile');
+      });
+
+      it('passes through already-converted paths', () => {
+        const paths = loadPaths();
+        expect(paths.toDockerMountPath('//mnt/host/c/foo')).toBe('//mnt/host/c/foo');
+      });
+
+      it('passes through Unix paths on Windows (container internal paths)', () => {
+        const paths = loadPaths();
+        expect(paths.toDockerMountPath('/app/services.json')).toBe('/app/services.json');
+      });
+    }
+  });
+
+  describe('Windows-specific defaults', () => {
+    if (process.platform === 'win32') {
+      it('caddyBase defaults to C:/caddy', () => {
+        const paths = loadPaths();
+        expect(paths.caddyBase).toBe('C:/caddy');
+      });
+
+      it('dockerData defaults to E:/dockerdata (network share)', () => {
+        const paths = loadPaths();
+        expect(paths.dockerData).toBe('E:/dockerdata');
+      });
+
+      it('caddyAdminUrl defaults to host.docker.internal (Docker Desktop)', () => {
+        const paths = loadPaths();
+        expect(paths.caddyAdminUrl).toContain('host.docker.internal');
+      });
+    }
+  });
+});