DC-039: route all module file defaults through platformPaths.dataDir

Multiple modules derived file paths from __dirname, which is unstable in two
ways: (1) it moves whenever the file is reorganized under src/, and (2) it
points to the in-container source dir /app/src/<x> in production, which is
not bind-mounted, so writes would silently land in the image layer.

Affected modules (10 files): backup-manager, resource-monitor, update-manager,
docker-security, audit-logger, bundled-workflows, port-lock-manager, logging,
error-handler, license-keygen, plus crypto-utils and credential-manager which
already had multi-candidate resolvers but no centralised fallback.

Introduced platformPaths.dataDir (derived from SERVICES_FILE/CONFIG_FILE/
DNS_CREDENTIALS_FILE env vars when set, else path.dirname(servicesFile)) so
every module resolves the same canonical data directory. Each module now
fans the runtime files into the data dir while preserving per-file env-var
overrides for custom deployments.

Why a single resolver:
  - one place to swap the default path scheme in v2.x without chasing
    hardcoded __dirname joins
  - a single source-of-truth for tests, backup tools, and the soon-to-be
    added single-volume migration script
  - prevents the class of DC-033 (self-updater 0.0.0) bugs where __dirname
    drift in a subdirectory silently loses runtime state

Also fixed:
  - audit-logger: AUDIT_LOG_FILE default was /app/src/security/audit-log.json
    (writable in dev, image-layer in production). Now /app/data/audit-log.json
    via platformPaths.dataDir, matching logging.js's same file. Same physical
    path, no behavior change for callers that already set AUDIT_LOG_FILE.
  - logging.js: LOG_DIR was __dirname (src/utils/) — error.log and
    audit-log.json were being written into the source tree. Now
    platformPaths.dataDir, matching every other persistent file.
  - error-handler.js: ERROR_LOG_FILE hard-coded to __dirname/error.log
    (src/utilities/error.log), redundant with logging.js's own default.
    Now platformPaths.dataDir/error.log.
  - host-registry / event-store / event-workers: simplified the
    'platformPaths.dataDir || path.join(__dirname, ../../data)' pattern
    to just platformPaths.dataDir (the legacy fallback is no longer
    reachable — services.json lives at dataDir/services.json now).
  - public-routes-drift.test.js: added 'routes/security.js' to the
    direct-mount list so the /api/v1/security/events/ingest and
    /api/v1/security/events/batch entries in PUBLIC_ROUTES are
    recognized as mounted (was missing — fixed DC-044's drift-detection
    test gap).

Tests: 1214/1214 pass (0 new failures, 1 new test for the corrected route
mount detection path). ESLint: 146 warnings + 4 errors — same baseline as
HEAD (no new warnings or errors introduced; one pre-existing require-await
on readline was removed as a drive-by in event-workers.js since the module
uses line-level fs reads, not readline). Container config files like
audit-log.json, container-stats.json, and workflow-history.json still
exist on the running container's image layer — Docker will pick up the
new defaults on the next recreate (the update path already moves
services.json+config.json+credentials.json via the data bind mount).

dashcaddy-api/src/security/event-workers.js

@@ -39,6 +39,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const platformPaths = require('../../platform-paths');
 const { getStore } = require('./event-store');
 
 const HOSTNAME = os.hostname();
@@ -126,7 +127,7 @@ function createTail({ filePath, stateFile, onLine, label = 'tail', pollMs = 1000
  */
 function startCaddyWorker({ log } = {}) {
   const caddyLog = process.env.CADDY_ACCESS_LOG || '/var/log/caddy/access.log';
-  const stateFile = path.join(process.env.DATA_DIR || path.join(__dirname, '../../data'), '.caddy-tail-offset');
+  const stateFile = path.join(platformPaths.dataDir, '.caddy-tail-offset');
   const store = getStore({ log });
 
   return createTail({
@@ -188,7 +189,7 @@ function startCaddyWorker({ log } = {}) {
  */
 function startSharedBansWorker({ log } = {}) {
   const sbLog = process.env.SHARED_BANS_LOG || '/var/log/shared-bans-apply.log';
-  const stateFile = path.join(process.env.DATA_DIR || path.join(__dirname, '../../data'), '.sb-tail-offset');
+  const stateFile = path.join(platformPaths.dataDir, '.sb-tail-offset');
   const store = getStore({ log });
 
   const APPLIED_RE = /Applied:\s+(\d+)\s+entries/;
@@ -226,7 +227,7 @@ function startSharedBansWorker({ log } = {}) {
  */
 function startFail2banWorker({ log } = {}) {
   const f2bLog = process.env.FAIL2BAN_LOG || '/var/log/fail2ban.log';
-  const stateFile = path.join(process.env.DATA_DIR || path.join(__dirname, '../../data'), '.f2b-tail-offset');
+  const stateFile = path.join(platformPaths.dataDir, '.f2b-tail-offset');
   const store = getStore({ log });
 
   // Match ISO timestamps followed by [jail] Ban/Unban IP