v1.13.4: Standardize all route responses to use response helpers

Convert ~160 raw res.json()/res.status().json() calls across 32+ files
to use centralized helpers from src/utils/responses.js (ok, errorResponse,
successMessage, notFound, validationError, forbidden, unauthorized, conflict).

No behavior changes — response shapes are identical. Future schema changes
(e.g., requestId envelope) only need to update one module.

Fix error vs errorResponse signature mismatch in routes/health.js CA cert
endpoint where error(res, message, statusCode) was being called with
errorResponse(res, statusCode, message, extras) argument order.

Files changed: middleware.js, csrf-protection.js, error-handler.js,
license-manager.js, src/app.js, and 27 route files.

Test suite: 755 pass / 4 pre-existing failures (services credential tests).

dashcaddy-api/csrf-protection.js

@@ -8,6 +8,7 @@
 
 const crypto = require('crypto');
 const cryptoUtils = require('./crypto-utils');
+const { errorResponse } = require('./src/utils/responses');
 
 const CSRF_TOKEN_LENGTH = 32;
 const CSRF_COOKIE_NAME = 'dashcaddy_csrf';
@@ -169,18 +170,14 @@ function csrfValidationMiddleware(req, res, next) {
   // Validate both values exist
   if (!cookieNonce) {
     console.warn(`[CSRF] Missing CSRF cookie: ${method} ${req.path} from ${req.ip}`);
-    return res.status(403).json({
-      success: false,
-      error: '[DC-100] CSRF token missing',
+    return errorResponse(res, 403, '[DC-100] CSRF token missing', {
       message: 'CSRF cookie not found. Please refresh the page (Ctrl+Shift+R) and try again.'
     });
   }
 
   if (!headerToken) {
     console.warn(`[CSRF] Missing CSRF header: ${method} ${req.path} from ${req.ip}`);
-    return res.status(403).json({
-      success: false,
-      error: '[DC-100] CSRF token missing',
+    return errorResponse(res, 403, '[DC-100] CSRF token missing', {
       message: 'CSRF token not provided in request headers. Please refresh the page (Ctrl+Shift+R) and try again.'
     });
   }
@@ -204,9 +201,7 @@ function csrfValidationMiddleware(req, res, next) {
 
   } catch (err) {
     console.warn(`[CSRF] Invalid CSRF token: ${method} ${req.path} from ${req.ip} - ${err.message}`);
-    return res.status(403).json({
-      success: false,
-      error: '[DC-101] CSRF token invalid',
+    return errorResponse(res, 403, '[DC-101] CSRF token invalid', {
       message: 'CSRF token validation failed. Please refresh the page (Ctrl+Shift+R) and try again.'
     });
   }