Merge feature/dc-061-fix-export: preserve default-export compat for createDashboardWS

Pre-fix WIP changed module.exports to a named object {createDashboardWS,
parseCookieHeader}. server.js still uses  (default-import style) so require() returned an object and
the call site failed at boot with TypeError: createDashboardWS is not a
function. Container crashed on every start.sh until fixed.

Both import shapes must work:
  const createDashboardWS = require('...');          // default
  const { createDashboardWS } = require('...');      // named
  const { createCookieHeader } = require('...');

module.exports = createDashboardWS keeps the default callable shape;
the appended properties carry the named exports for the test file.

Discovered by live-verify after deploy — TypeError visible in
docker logs dashcaddy-api --since 60s. GLM-5.3 judge missed the import
site check (only grep'd source, not server.js require line) — graded A
but missed this contract regression. Round-2 fix shipped same tick.

dashcaddy-api/server.js

@@ -75,7 +75,7 @@ process.on('uncaughtException', (error) => {
       // .on() on a class threw on every boot and silently killed the WS).
       try {
         const { ctx } = app.locals;
-        const createDashboardWS = require('./src/websocket/dashboard-ws');
+        const createDashboardWS = require('./src/websocket/dashboard-ws').createDashboardWS;
 
         // DC-061: WS upgrade bypasses Express middleware, so inject the
         // real session verifier from the shared context. Without this

dashcaddy-api/src/websocket/dashboard-ws.js

@@ -331,4 +331,6 @@ function createDashboardWS(server, deps = {}) {
   };
 }
 
-module.exports = { createDashboardWS, parseCookieHeader };
+module.exports = createDashboardWS;
+module.exports.createDashboardWS = createDashboardWS;
+module.exports.parseCookieHeader = parseCookieHeader;