DC-020: fix last broken require in server.js (./state-manager -> ./src/managers/state-manager)

The DC-020 require-path sweep fixed every '../src/...' -> './src/...' in
server.js, but missed one: line 73 still had .
From the production entry point (/app/server.js) this resolves to
/app/state-manager.js — a file that does NOT exist (the module lives at
src/managers/state-manager.js). Unlike the optional modules below it,
this require is bare (not wrapped in try/catch), so a MODULE_NOT_FOUND
here throws out of the top-level startup IIFE and crash-loops the
container — the exact same failure mode as the deleted license-keygen.js.

Fix: ./state-manager -> ./src/managers/state-manager (matches line 146).

Also hardens the DC-020 regression guard (app-startup-smoke.test.js):
adds a static check that EVERY relative require() in server.js resolves
to a real file on disk. server.js cannot be require()'d at test time
(its IIFE binds port 3001 + starts interval modules, leaking workers),
so the static scan is what catches this class of entry-point path bug.
This test would have failed on the original ./state-manager line.

1067/1067 tests pass (was 1066 baseline + 1 new). Zero new ESLint warnings.

dashcaddy-api/server.js

@@ -70,7 +70,7 @@ process.on('uncaughtException', (error) => {
       const portLockManager = require('./src/managers/port-lock-manager');
 
       // Create servicesStateManager early — needed by workflow engine init
-      const StateManager = require('./state-manager');
+      const StateManager = require('./src/managers/state-manager');
       const servicesStateManager = new StateManager(SERVICES_FILE);
 
       // Optional modules