fix(updates): allow notify endpoint past CSRF + portable JSON parse in release.sh

- csrf-protection: skip CSRF validation on /api/system/update-notify. The
  endpoint has its own X-DashCaddy-Notify-Secret auth and is only ever called
  machine-to-machine; browsers never reach it. Without this, the CSRF cookie
  check rejects the notify POST before the secret comparison runs.
- release.sh: the verify step piped curl into `node -p ".../dev/stdin"` which
  works on Linux but blows up on Windows/git-bash. Replaced with portable
  grep+sed extraction so the same script works on both publisher OSes.

dashcaddy-api/csrf-protection.js

@@ -122,7 +122,10 @@ function csrfValidationMiddleware(req, res, next) {
     '/api/totp/verify-setup',
     '/api/totp/setup',
     '/health',
-    '/api/health'
+    '/api/health',
+    // Machine-to-machine: publishing host POSTs here with its own shared-secret
+    // header (X-DashCaddy-Notify-Secret) — browsers never reach this endpoint.
+    '/api/system/update-notify'
   ];
 
   // Normalize /api/v1/... to /api/... so exclusions work with both prefixes