ADFA-5339 feat(dashboard): rebuild-log endpoint, opt-in website refresh (server half)

[luisguzman-adfa]

Phase 1 server half of the Dashboard-update card. Two additive, localhost-only endpoints the app
UI will build on (in a separate PR), plus two robustness fixes that device verification surfaced.
No user-facing change here; verified end-to-end by curl on device (dash-node 1.2.11 → 1.2.12).

Touches only static/dashboard/ + tools/ — no controller/app/, so it can't conflict with the
app PRs.

Endpoints

• GET /system/dashboard/rebuild/log — read-only tail of /var/log/dash-rebuild.log (last ~200
  lines; a whole rebuild fits). No rebuild yet = empty log, not an error. Feeds the card's Details.
• POST /system/dashboard/rebuild accepts { site: true } → refreshes the served landing page in
  the same run via site-updater.sh, from the same clone the rebuild's git fetch+reset refreshes,
  in finalize after the core swap verifies live, so the site matches the new source.

Semantics (per the ticket's "read first")

The REST core and the landing site are separate artifacts. The version belongs to the core; the site
never carries one. Enforced by construction: site-updater.sh touches neither package.json nor the
reported version, and a site failure is logged, never a rollback of the already-verified core update.
Verified on device: after a site:true rebuild, system/version was unchanged and /home/ served
the fresh landing page.

Two fixes device verification caught

• sh → bash for site-updater (rebuild-dashboard.sh). It's a bash script (${BASH_SOURCE[0]},
  arrays); invoking it with sh (dash) tripped on the bash-isms and mis-resolved its own source dir to
  /root. The best-effort guard had contained it — the core stayed 1.2.12 — but the site step failed.
• Validate the source before wiping the destination (site-updater.sh). The mirror wiped the
  served dir before checking the source, so the mis-resolved /root deleted the site and copied the
  wrong tree with no rollback. The [ -d ] guard was too weak (a wrong-but-existing dir passes);
  replaced with [ -f "$SITE_SRC/index.html" ], which only the real site satisfies — one stronger
  guard instead of two, refusing (changing nothing) on a bad source.

Deploy note

Because rebuild-dashboard.sh self-updates via git reset, a box needs the rebuild run twice to
pick up these script changes: the first run executes the pre-fix script in memory while fetching the
new one; the second runs the new one.

dash-node 1.2.11 → 1.2.12.