Consolidate response helpers and error logger to single modules

Two cleanups in one pass for the v1.14.0 'works on any platform' theme:

1. Response helpers — merged src/utils/responses.js and the root-level
   response-helpers.js into a single module at src/utils/responses.js.
   The old module had a richer set (created, noContent, validationError,
   unauthorized, forbidden, notFound, conflict) and is now re-exported
   from the new location. Updated 15 routes to import from
   src/utils/responses and deleted the root response-helpers.js.

2. Error logger — error-handler.js now uses the unified
   src/utils/logging.js#logError (same one src/app.js uses), so all errors
   go to one log file with one rotation policy. Removed the dead
   asyncHandler export (the real one is in src/utils/async-handler.js
   and is used everywhere). Deleted the legacy error-logger.js.

Both are invisible to users — same HTTP response shapes, same log file
path, same error format. Internal-only refactor.

dashcaddy-api/src/utils/responses.js

@@ -1,22 +1,124 @@
 /**
  * Response helpers - Standard API response formats
+ *
+ * Single source of truth for HTTP response shapes across DashCaddy.
+ * Standard envelope: { success: true, ...data } or { success: false, error: "..." }.
+ *
+ * All routes should import from this module — do not call res.json/res.status
+ * directly with the response shape, use these helpers instead.
  */
+const { HTTP_STATUS } = require('../../constants');
+
+// ── Success helpers ────────────────────────────────────────────
 
 /**
- * Standard error response
+ * Standard success response. Use this in route handlers.
+ * Wraps the data object with a `success: true` envelope.
+ * @param {object} res Express response
+ * @param {object} [data={}] fields to include in the response body
+ * @param {number} [statusCode=200] HTTP status code
+ */
+function ok(res, data = {}, statusCode = HTTP_STATUS.OK) {
+  return res.status(statusCode).json({ success: true, ...data });
+}
+
+/**
+ * Alias for `ok` — prefer `ok` in new code, but kept for code that imports as `success`.
+ */
+function success(res, data, statusCode) {
+  return ok(res, data, statusCode);
+}
+
+/**
+ * Success response with a human-readable message field.
+ * Use when there's no data to return, just confirmation.
+ */
+function successMessage(res, message, statusCode = HTTP_STATUS.OK) {
+  return res.status(statusCode).json({ success: true, message });
+}
+
+/**
+ * 201 Created response.
+ */
+function created(res, data = {}) {
+  return res.status(HTTP_STATUS.CREATED).json({ success: true, ...data });
+}
+
+/**
+ * 204 No Content response.
+ */
+function noContent(res) {
+  return res.status(HTTP_STATUS.NO_CONTENT).send();
+}
+
+// ── Error helpers ──────────────────────────────────────────────
+
+/**
+ * Standard error response. Use this in route handlers.
+ * @param {object} res Express response
+ * @param {number} statusCode HTTP status code
+ * @param {string} message Human-readable error message
+ * @param {object} [extras={}] additional fields to merge into the response
  */
 function errorResponse(res, statusCode, message, extras = {}) {
   return res.status(statusCode).json({ success: false, error: message, ...extras });
 }
 
 /**
- * Standard success response
+ * Alias for `errorResponse` — kept for code that imports as `error`.
  */
-function ok(res, data = {}) {
-  return res.json({ success: true, ...data });
+function error(res, message, statusCode = HTTP_STATUS.INTERNAL_ERROR) {
+  return res.status(statusCode).json({ success: false, error: message });
+}
+
+/**
+ * 400 Bad Request — invalid input from the user.
+ */
+function validationError(res, message) {
+  return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: message });
+}
+
+/**
+ * 401 Unauthorized — no valid credentials.
+ */
+function unauthorized(res, message = 'Unauthorized') {
+  return res.status(HTTP_STATUS.UNAUTHORIZED).json({ success: false, error: message });
+}
+
+/**
+ * 403 Forbidden — credentials valid but permission denied.
+ */
+function forbidden(res, message = 'Forbidden') {
+  return res.status(HTTP_STATUS.FORBIDDEN).json({ success: false, error: message });
+}
+
+/**
+ * 404 Not Found — resource doesn't exist.
+ */
+function notFound(res, message = 'Not found') {
+  return res.status(HTTP_STATUS.NOT_FOUND).json({ success: false, error: message });
+}
+
+/**
+ * 409 Conflict — request conflicts with current state (e.g. duplicate).
+ */
+function conflict(res, message) {
+  return res.status(HTTP_STATUS.CONFLICT).json({ success: false, error: message });
 }
 
 module.exports = {
-  errorResponse,
+  // Success helpers
   ok,
+  success,
+  successMessage,
+  created,
+  noContent,
+  // Error helpers
+  errorResponse,
+  error,
+  validationError,
+  unauthorized,
+  forbidden,
+  notFound,
+  conflict,
 };