DC-010: convert res.json({success:true,...}) → ok() in updates/notifications/tailscale

Routes converted: updates.js (17), notifications.js (8), tailscale.js (12).
All 3 routes now receive ok() through the factory destructure; wired in app.js.

notifications.js: kept 2 res.json() calls for genuine partial-failure semantics
  - POST /test with ?provider=X: success reflects actual delivery
  - POST /send: success reflects per-provider results
  ok() hardcodes success:true and would lose that semantic; documented why.

tailscale.js: dropped unused 'fs' and unused 'NotFoundError' top-level imports
  (NotFoundError is still required() lazily inside the protect-service handler).
  Net change: 12 calls cleaned up, 2 lint warnings fixed.

750/750 tests still pass.

dashcaddy-api/routes/tailscale.js

@@ -1,8 +1,7 @@
 const express = require('express');
-const fs = require('fs');
 const { TAILSCALE } = require('../constants');
 const { exists } = require('../fs-helpers');
-const { ValidationError, NotFoundError } = require('../errors');
+const { ValidationError, NotFoundError: _NotFoundError } = require('../errors');
 
 /**
  * Tailscale route factory
@@ -13,6 +12,7 @@ const { ValidationError, NotFoundError } = require('../errors');
  * @param {Object} deps.credentialManager - Credential manager
  * @param {Function} deps.buildDomain - Domain builder function
  * @param {Function} deps.asyncHandler - Async route handler wrapper
+ * @param {Function} deps.ok - Success response helper
  * @param {string} deps.SERVICES_FILE - Path to services.json
  * @param {Object} deps.log - Logger instance
  * @returns {express.Router}
@@ -24,6 +24,7 @@ module.exports = function({
   credentialManager,
   buildDomain,
   asyncHandler,
+  ok,
   SERVICES_FILE,
   log
 }) {
@@ -35,8 +36,7 @@ module.exports = function({
     const localIP = await tailscale.getLocalIP();
 
     if (!status) {
-      return res.json({
-        success: true,
+      return ok(res, {
         installed: false,
         connected: false,
         message: 'Tailscale not available or not running'
@@ -58,8 +58,7 @@ module.exports = function({
       }
     }
 
-    res.json({
-      success: true,
+    ok(res, {
       installed: true,
       connected: status.BackendState === 'Running',
       backendState: status.BackendState,
@@ -85,8 +84,7 @@ module.exports = function({
 
     await tailscale.save();
 
-    res.json({
-      success: true,
+    ok(res, {
       message: 'Tailscale configuration updated',
       config: tailscale.config
     });
@@ -101,8 +99,7 @@ module.exports = function({
     const ipsToCheck = [clientIP, forwardedFor, realIP].filter(Boolean);
     const isTailscale = ipsToCheck.some(ip => tailscale.isTailscaleIP(ip.toString().split(',')[0].trim()));
 
-    res.json({
-      success: true,
+    ok(res, {
       isTailscale,
       clientIP,
       forwardedFor: forwardedFor || null,
@@ -114,7 +111,7 @@ module.exports = function({
   router.get('/devices', asyncHandler(async (req, res) => {
     const status = await tailscale.getStatus();
     if (!status || !status.Peer) {
-      return res.json({ success: true, devices: [] });
+      return ok(res, { devices: [] });
     }
 
     const devices = [];
@@ -141,7 +138,7 @@ module.exports = function({
       });
     }
 
-    res.json({ success: true, devices });
+    ok(res, { devices });
   }, 'tailscale-devices'));
 
   // Toggle Tailscale-only mode for an existing service
@@ -190,8 +187,7 @@ module.exports = function({
       });
     }
 
-    res.json({
-      success: true,
+    ok(res, {
       message: `Service ${domain} is now ${tailscaleOnly !== false ? 'protected by' : 'no longer restricted to'} Tailscale`,
       tailscaleOnly: tailscaleOnly !== false
     });
@@ -254,7 +250,7 @@ module.exports = function({
       log.warn('tailscale', 'Initial sync after OAuth config failed', { error: e.message });
     }
 
-    res.json({ success: true, config: tailscale.config });
+    ok(res, { config: tailscale.config });
   }, 'tailscale-oauth-config'));
 
   // Remove OAuth credentials and disable API sync
@@ -269,7 +265,7 @@ module.exports = function({
 
     tailscale.stopSync();
 
-    res.json({ success: true, message: 'Tailscale OAuth credentials removed' });
+    ok(res, { message: 'Tailscale OAuth credentials removed' });
   }, 'tailscale-oauth-delete'));
 
   // Get enriched device list from Tailscale API
@@ -279,8 +275,7 @@ module.exports = function({
     }
 
     // Return cached devices from last sync
-    res.json({
-      success: true,
+    ok(res, {
       devices: tailscale.config.devices || [],
       lastSync: tailscale.config.lastSync
     });
@@ -294,8 +289,7 @@ module.exports = function({
 
     const devices = await tailscale.syncAPI();
 
-    res.json({
-      success: true,
+    ok(res, {
       devices: devices || [],
       lastSync: tailscale.config.lastSync
     });
@@ -325,7 +319,7 @@ module.exports = function({
       sshRuleCount: (acl.ssh || []).length
     };
 
-    res.json({ success: true, acl, summary });
+    ok(res, { acl, summary });
   }, 'tailscale-acl'));
 
   return router;