v1.13.4: Standardize all route responses to use response helpers

Convert ~160 raw res.json()/res.status().json() calls across 32+ files
to use centralized helpers from src/utils/responses.js (ok, errorResponse,
successMessage, notFound, validationError, forbidden, unauthorized, conflict).

No behavior changes — response shapes are identical. Future schema changes
(e.g., requestId envelope) only need to update one module.

Fix error vs errorResponse signature mismatch in routes/health.js CA cert
endpoint where error(res, message, statusCode) was being called with
errorResponse(res, statusCode, message, extras) argument order.

Files changed: middleware.js, csrf-protection.js, error-handler.js,
license-manager.js, src/app.js, and 27 route files.

Test suite: 755 pass / 4 pre-existing failures (services credential tests).

dashcaddy-api/routes/arr/detect.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const { APP_PORTS, ARR_SERVICES } = require('../../constants');
+const { ok } = require('../../src/utils/responses');
 
 /**
  * Arr service detection routes factory
@@ -62,8 +63,7 @@ module.exports = function({ docker, servicesStateManager, credentialManager, fet
       detected.plex.token = await helpers.getPlexToken(detected.plex.containerName);
     }
 
-    res.json({
-      success: true,
+    ok(res, {
       services: detected,
       summary: {
         plexReady: !!(detected.plex?.token),
@@ -287,7 +287,7 @@ module.exports = function({ docker, servicesStateManager, credentialManager, fet
       readyForAutoConnect: statuses.filter(s => s.status === 'connected').length >= 2
     };
 
-    res.json({ success: true, services: result, seedboxBaseUrl: detectedSeedboxUrl, summary });
+    ok(res, { services: result, seedboxBaseUrl: detectedSeedboxUrl, summary });
   }, 'smart-detect'));
 
   return router;