v1.13.4: Standardize all route responses to use response helpers

Convert ~160 raw res.json()/res.status().json() calls across 32+ files
to use centralized helpers from src/utils/responses.js (ok, errorResponse,
successMessage, notFound, validationError, forbidden, unauthorized, conflict).

No behavior changes — response shapes are identical. Future schema changes
(e.g., requestId envelope) only need to update one module.

Fix error vs errorResponse signature mismatch in routes/health.js CA cert
endpoint where error(res, message, statusCode) was being called with
errorResponse(res, statusCode, message, extras) argument order.

Files changed: middleware.js, csrf-protection.js, error-handler.js,
license-manager.js, src/app.js, and 27 route files.

Test suite: 755 pass / 4 pre-existing failures (services credential tests).

dashcaddy-api/license-manager.js

@@ -15,6 +15,7 @@ const os = require('os');
 const fs = require('fs');
 const path = require('path');
 const { verifyCode, parseCode, VALID_DURATIONS } = require('./license-keygen');
+const { errorResponse } = require('./src/utils/responses');
 
 const LICENSE_CRED_KEY = 'license.activation';
 const LICENSE_SERVER_URL = process.env.LICENSE_SERVER_URL || null; // Set when license server exists
@@ -344,9 +345,7 @@ class LicenseManager {
       }
 
       const featureInfo = PREMIUM_FEATURES[feature] || { name: feature };
-      return res.status(403).json({
-        success: false,
-        error: `${featureInfo.name} requires a DashCaddy Premium subscription.`,
+      return errorResponse(res, 403, `${featureInfo.name} requires a DashCaddy Premium subscription.`, {
         premiumRequired: true,
         feature,
         featureName: featureInfo.name,