DC-010: convert res.json({success:true,...}) → ok() in updates/notifications/tailscale

Routes converted: updates.js (17), notifications.js (8), tailscale.js (12).
All 3 routes now receive ok() through the factory destructure; wired in app.js.

notifications.js: kept 2 res.json() calls for genuine partial-failure semantics
  - POST /test with ?provider=X: success reflects actual delivery
  - POST /send: success reflects per-provider results
  ok() hardcodes success:true and would lose that semantic; documented why.

tailscale.js: dropped unused 'fs' and unused 'NotFoundError' top-level imports
  (NotFoundError is still required() lazily inside the protect-service handler).
  Net change: 12 calls cleaned up, 2 lint warnings fixed.

750/750 tests still pass.

dashcaddy-api/src/app.js

@@ -400,7 +400,8 @@ function createApp() {
   }));
   apiRouter.use('/notifications', notificationRoutes({
     notification: ctx.notification,
-    asyncHandler: ctx.asyncHandler
+    asyncHandler: ctx.asyncHandler,
+    ok: ctx.ok
   }));
   apiRouter.use('/containers', containerRoutes({
     docker: ctx.docker,
@@ -444,7 +445,8 @@ function createApp() {
     updateManager: ctx.updateManager,
     selfUpdater: ctx.selfUpdater,
     asyncHandler: ctx.asyncHandler,
-    logError: ctx.logError
+    logError: ctx.logError,
+    ok: ctx.ok
   }));
   apiRouter.use('/tailscale', tailscaleRoutes({
     tailscale: ctx.tailscale,
@@ -453,6 +455,7 @@ function createApp() {
     credentialManager: ctx.credentialManager,
     buildDomain: ctx.buildDomain,
     asyncHandler: ctx.asyncHandler,
+    ok: ctx.ok,
     SERVICES_FILE: ctx.SERVICES_FILE,
     log: ctx.log
   }));