Add DKIM auto-provisioning, OS/panel self-update with self-healing

- AccountManager: auto-generate DKIM keypair + inject SPF/DKIM/DMARC DNS records on account create
- AccountManager: rotateDKIM() method for key rotation with new selector
- New dkim.php endpoint: list/view/rotate/provision DKIM keys per domain
- schema.sql: add dkim_keys table
- install.sh: install opendkim, wire into Postfix milter, fix dotfile copy (. vs *), fix config.ini permissions (root:www-data 640), copy VERSION to web root, add opendkim to service restart
- api/index.php: fix NOVACPX_ROOT path (was 2 levels too high), fix CORS ports (8880-8883), VERSION fallback to /opt/novacpx-src
- api/.htaccess: route all /api/* requests through index.php
- system.php: check-os-update, apply-os-update (self-healing: auto-restart downed services, restore web root if panel ports go down), check-novacpx-update, apply-novacpx-update (PHP syntax validation before deploy, backup + restore on failure)
- admin.js: Updates page now shows both NovaCPX panel updates and OS package upgrades in one section; sidebar badge shows combined count

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

db/schema.sql

@@ -369,4 +369,16 @@ INSERT INTO settings (`key`, `value`) VALUES
   ('git_remote',       'https://github.com/myronblair/novacpx.git')
 ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);
 
+CREATE TABLE IF NOT EXISTS dkim_keys (
+  `id`               INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+  `account_id`       INT UNSIGNED NOT NULL,
+  `domain`           VARCHAR(253) NOT NULL,
+  `selector`         VARCHAR(63)  NOT NULL DEFAULT 'mail',
+  `public_key`       TEXT         NOT NULL,
+  `private_key_path` VARCHAR(500) NOT NULL,
+  `created_at`       DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  UNIQUE KEY uq_domain (domain),
+  CONSTRAINT fk_dkim_acct FOREIGN KEY (account_id) REFERENCES accounts(id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
 SET foreign_key_checks = 1;