Fix Tailscale route prefix mismatch and increase health check timeout

Mount Tailscale router at /tailscale prefix so all 10 routes resolve
to /api/tailscale/* as expected by middleware, audit logger, and
frontend. Previously 5 routes (status, config, check-connection,
devices, protect-service) resolved to /api/* instead, with config
colliding with the settings route. Strip redundant /tailscale/ prefix
from OAuth routes that were compensating for the missing mount prefix.

Increase default health check timeout from 10s to 20s to reduce false
positives on slower services.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dashcaddy-api/health-checker.js

@@ -168,7 +168,7 @@ class HealthChecker extends EventEmitter {
         port: url.port || (url.protocol === 'https:' ? 443 : 80),
         path: url.pathname + url.search,
         method,
-        timeout: config.timeout || 10000,
+        timeout: config.timeout || 20000,
         headers: config.headers || {},
         rejectUnauthorized: false // Trust internal CA certs (.sami TLD)
       };
@@ -497,7 +497,7 @@ class HealthChecker extends EventEmitter {
       name: config.name || serviceId,
       url: config.url,
       method: config.method || 'GET',
-      timeout: config.timeout || 10000,
+      timeout: config.timeout || 20000,
       expectedStatusCodes: config.expectedStatusCodes || [200],
       expectedBodyPattern: config.expectedBodyPattern,
       expectedBodyContains: config.expectedBodyContains,