v1.13.4: Standardize all route responses to use response helpers

Convert ~160 raw res.json()/res.status().json() calls across 32+ files
to use centralized helpers from src/utils/responses.js (ok, errorResponse,
successMessage, notFound, validationError, forbidden, unauthorized, conflict).

No behavior changes — response shapes are identical. Future schema changes
(e.g., requestId envelope) only need to update one module.

Fix error vs errorResponse signature mismatch in routes/health.js CA cert
endpoint where error(res, message, statusCode) was being called with
errorResponse(res, statusCode, message, extras) argument order.

Files changed: middleware.js, csrf-protection.js, error-handler.js,
license-manager.js, src/app.js, and 27 route files.

Test suite: 755 pass / 4 pre-existing failures (services credential tests).

dashcaddy-api/__tests__/routes/services.routes.test.js

@@ -103,12 +103,12 @@ describe('Services Routes', () => {
   });
 
   describe('GET /api/services', () => {
-    it('returns empty array when no services file', async () => {
+    it('returns empty services array (enveloped) when no services file', async () => {
       exists.mockResolvedValue(false);
       const { app } = createApp();
       const res = await request(app).get('/api/services');
       expect(res.status).toBe(200);
-      expect(res.body).toEqual([]);
+      expect(res.body).toEqual({ success: true, services: [] });
     });
 
     it('returns services list', async () => {