v1.13.4: Standardize all route responses to use response helpers

Convert ~160 raw res.json()/res.status().json() calls across 32+ files
to use centralized helpers from src/utils/responses.js (ok, errorResponse,
successMessage, notFound, validationError, forbidden, unauthorized, conflict).

No behavior changes — response shapes are identical. Future schema changes
(e.g., requestId envelope) only need to update one module.

Fix error vs errorResponse signature mismatch in routes/health.js CA cert
endpoint where error(res, message, statusCode) was being called with
errorResponse(res, statusCode, message, extras) argument order.

Files changed: middleware.js, csrf-protection.js, error-handler.js,
license-manager.js, src/app.js, and 27 route files.

Test suite: 755 pass / 4 pre-existing failures (services credential tests).

dashcaddy-api/routes/arr/credentials.js

@@ -1,6 +1,7 @@
 const express = require('express');
 const { validateURL, validateToken } = require('../../input-validator');
 const { ValidationError } = require('../../errors');
+const { ok, successMessage } = require('../../src/utils/responses');
 
 /**
  * Arr credentials routes factory
@@ -101,12 +102,7 @@ module.exports = function({ credentialManager, servicesStateManager, asyncHandle
 
     log.info('arr', 'Stored API key', { service, verified: connectionTest?.success || false });
 
-    res.json({
-      success: true,
-      message: `${service} API key stored`,
-      connectionTest,
-      url: resolvedUrl
-    });
+    ok(res, { message: `${service} API key stored`, connectionTest, url: resolvedUrl });
   }, 'arr-credentials-store'));
 
   // List stored arr credentials (keys only, not values)
@@ -131,7 +127,7 @@ module.exports = function({ credentialManager, servicesStateManager, asyncHandle
     // Get seedbox base URL
     const seedboxBaseUrl = await credentialManager.retrieve('arr.seedbox.baseurl');
 
-    res.json({ success: true, credentials, seedboxBaseUrl: seedboxBaseUrl || null });
+    ok(res, { credentials, seedboxBaseUrl: seedboxBaseUrl || null });
   }, 'arr-credentials-list'));
 
   // Delete stored arr credentials
@@ -140,7 +136,7 @@ module.exports = function({ credentialManager, servicesStateManager, asyncHandle
     const credKey = service === 'plex' ? 'arr.plex.token' : `arr.${service}.apikey`;
     await credentialManager.delete(credKey);
     log.info('arr', 'Deleted credentials', { service });
-    res.json({ success: true, message: `${service} credentials removed` });
+    successMessage(res, `${service} credentials removed`);
   }, 'arr-credentials-delete'));
 
   return router;