feat(updates): seamless release flow — push-notify, VERSION copy, robust mirror

- self-updater: per-instance notify secret (auto-generated), notifyAndApply()
  triggers an immediate check+apply for the publishing host
- routes: POST /api/system/update-notify (X-DashCaddy-Notify-Secret gated,
  added to public-routes allowlist so TOTP doesn't block machine-to-machine)
- dashcaddy-update.sh: include VERSION in backup/deploy/rollback copy lists;
  belt-and-suspenders write trigger.json commit to VERSION post-deploy.
  Fixes drift where /app/VERSION stayed at the old commit after self-update.
- release.sh: mirror failures are non-fatal+loud; HTTP-verify get2 after
  rsync; auto-notify co-located instance via /opt/dashcaddy/updates/notify-secret
  (or honour DASHCADDY_NOTIFY_TARGETS for multi-instance setups).

dashcaddy-api/middleware.js

@@ -299,6 +299,7 @@ module.exports = function configureMiddleware(app, {
     { path: '/api/license/feature/',  prefix: true, method: 'GET' },
     { path: '/api/config',             exact: true,  method: 'GET' },
     { path: '/api/services/status',    exact: true,  method: 'GET' },
+    { path: '/api/system/update-notify', exact: true, method: 'POST' },
   ];
 
   function isPublicRoute(req) {