refactor(persistence): canonical atomic file writer + notifications.json crash-safety (DC-099) [glm-grade=B]

- src/utils/atomic-write.js: single shared tmp+fsync+rename writer
  (exclusive-create 0600, unique tmp names, cleanup-on-failure,
  best-effort parent-dir fsync after rename for swap durability)
- notification-manager: both write paths (load-time canonicalization
  write-back + saveConfig) converted from plain writeFileSync — a
  crash mid-write can no longer truncate notifications.json
- DC-097/098 test seams migrated to the atomic path; new suite pins
  syscall discipline (order, wx flags, tmp naming, error cleanup,
  dir-fsync swallow)
- 121 suites / 2768 tests green
- Judge: GLM-5.3 cold read grade B/ship (deleg_23f7abad); polish items
  folded: dir-fsync added, header copy-count corrected. Remaining:
  migrate invite/user/share-store private _atomicWriteJSON copies as
  they are touched (queued).

URN: pending (recorded post-commit)

dashcaddy-api/__tests__/notification-manager.test.js

@@ -10,6 +10,13 @@ jest.mock('fs', () => ({
   readFileSync: jest.fn().mockReturnValue('{}'),
   writeFileSync: jest.fn(),
   mkdirSync: jest.fn(),
+  // DC-099 atomic write path (open tmp → write → fsync → close → rename).
+  openSync: jest.fn().mockReturnValue(3),
+  writeSync: jest.fn(),
+  fsyncSync: jest.fn(),
+  closeSync: jest.fn(),
+  renameSync: jest.fn(),
+  unlinkSync: jest.fn(),
 }));
 
 jest.mock('nodemailer', () => ({
@@ -63,10 +70,12 @@ describe('NotificationManager', () => {
     fs.existsSync.mockReturnValue(false);
     await nm.saveConfig();
     expect(fs.mkdirSync).toHaveBeenCalled();
-    expect(fs.writeFileSync).toHaveBeenCalled();
-    const callArgs = fs.writeFileSync.mock.calls[0];
-    expect(callArgs[0]).toBe(NOTIF_FILE);
-    expect(callArgs[1]).toContain('enabled');
+    // DC-099: atomic write path — payload lands via writeSync, then tmp is renamed onto the target.
+    expect(fs.writeSync).toHaveBeenCalled();
+    expect(fs.renameSync).toHaveBeenCalled();
+    const writeArgs = fs.writeSync.mock.calls[0];
+    expect(fs.renameSync.mock.calls[0][1]).toBe(NOTIF_FILE);
+    expect(writeArgs[1]).toContain('enabled');
   });
 
   test('loadConfig merges file content with defaults', () => {