v1.13.4: Standardize all route responses to use response helpers

Convert ~160 raw res.json()/res.status().json() calls across 32+ files
to use centralized helpers from src/utils/responses.js (ok, errorResponse,
successMessage, notFound, validationError, forbidden, unauthorized, conflict).

No behavior changes — response shapes are identical. Future schema changes
(e.g., requestId envelope) only need to update one module.

Fix error vs errorResponse signature mismatch in routes/health.js CA cert
endpoint where error(res, message, statusCode) was being called with
errorResponse(res, statusCode, message, extras) argument order.

Files changed: middleware.js, csrf-protection.js, error-handler.js,
license-manager.js, src/app.js, and 27 route files.

Test suite: 755 pass / 4 pre-existing failures (services credential tests).

dashcaddy-api/routes/auth/keys.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const { ValidationError, ForbiddenError, NotFoundError } = require('../../errors');
+const { ok, successMessage } = require('../../src/utils/responses');
 /**
  * Auth API keys routes factory
  * @param {Object} deps - Explicit dependencies
@@ -39,7 +40,7 @@ module.exports = function({ authManager, asyncHandler, log }) {
     }
 
     const keys = await authManager.listAPIKeys();
-    res.json({ success: true, keys });
+    ok(res, { keys });
   }, 'auth-keys-list'));
 
   // Generate new API key
@@ -66,8 +67,7 @@ module.exports = function({ authManager, asyncHandler, log }) {
       scopes || ['read', 'write']
     );
 
-    res.json({
-      success: true,
+    ok(res, {
       key: keyData.key,
       id: keyData.id,
       name: keyData.name,
@@ -93,7 +93,7 @@ module.exports = function({ authManager, asyncHandler, log }) {
     const success = await authManager.revokeAPIKey(keyId);
 
     if (success) {
-      res.json({ success: true, message: 'API key revoked successfully' });
+      successMessage(res, 'API key revoked successfully');
     } else {
       throw new NotFoundError(`API key ${keyId}`);
     }
@@ -126,8 +126,7 @@ module.exports = function({ authManager, asyncHandler, log }) {
     const expiresInMs = parseExpiration(expiresIn || '24h');
     const expiresAt = new Date(Date.now() + expiresInMs).toISOString();
 
-    res.json({
-      success: true,
+    ok(res, {
       token,
       expiresAt,
       usage: 'Include in Authorization header as: Bearer <token>'

dashcaddy-api/routes/auth/totp.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const { ValidationError, AuthenticationError } = require('../../errors');
+const { ok, successMessage } = require('../../src/utils/responses');
 
 /**
  * Auth TOTP routes factory
@@ -27,8 +28,7 @@ module.exports = function({ authManager, credentialManager, totpConfig, saveTotp
 
   // Get current TOTP config (public route)
   router.get('/totp/config', asyncHandler(async (req, res) => {
-    res.json({
-      success: true,
+    ok(res, {
       config: {
         enabled: ctx.totpConfig.enabled,
         sessionDuration: ctx.totpConfig.sessionDuration,
@@ -62,7 +62,7 @@ module.exports = function({ authManager, credentialManager, totpConfig, saveTotp
       color: { dark: '#ffffff', light: '#00000000' }
     });
 
-    res.json({ success: true, qrCode: qrDataUrl, manualKey: secret, issuer: 'DashCaddy', imported: !!req.body?.secret });
+    ok(res, { qrCode: qrDataUrl, manualKey: secret, issuer: 'DashCaddy', imported: !!req.body?.secret });
   }, 'totp-setup'));
 
   // Verify first code to confirm setup, then activate TOTP
@@ -99,7 +99,7 @@ module.exports = function({ authManager, credentialManager, totpConfig, saveTotp
     ctx.session.create(req, ctx.totpConfig.sessionDuration);
     ctx.session.setCookie(res, ctx.totpConfig.sessionDuration);
 
-    res.json({ success: true, message: 'TOTP enabled successfully', sessionDuration: ctx.totpConfig.sessionDuration });
+    ok(res, { message: 'TOTP enabled successfully', sessionDuration: ctx.totpConfig.sessionDuration });
   }, 'totp-verify-setup'));
 
   // Login: verify TOTP code and set session cookie
@@ -133,7 +133,7 @@ module.exports = function({ authManager, credentialManager, totpConfig, saveTotp
     const newCsrfToken = renewCSRFToken(res, req.secure || req.protocol === 'https');
 
     log.debug('auth', 'Session created', { sessions: ctx.session.ipSessions.size });
-    res.json({ success: true, message: 'Authenticated successfully', sessionDuration: ctx.totpConfig.sessionDuration, csrfToken: newCsrfToken });
+    ok(res, { message: 'Authenticated successfully', sessionDuration: ctx.totpConfig.sessionDuration, csrfToken: newCsrfToken });
   }, 'totp-verify'));
 
   // Check session validity (used by Caddy forward_auth)
@@ -185,7 +185,7 @@ module.exports = function({ authManager, credentialManager, totpConfig, saveTotp
 
     ctx.session.clear(req);
     ctx.session.clearCookie(res);
-    res.json({ success: true, message: 'TOTP disabled' });
+    successMessage(res, 'TOTP disabled');
   }, 'totp-disable'));
 
   // Update TOTP settings (session duration)
@@ -204,8 +204,7 @@ module.exports = function({ authManager, credentialManager, totpConfig, saveTotp
     }
 
     await ctx.saveTotpConfig();
-    res.json({
-      success: true,
+    ok(res, {
       config: { enabled: ctx.totpConfig.enabled, sessionDuration: ctx.totpConfig.sessionDuration, isSetUp: ctx.totpConfig.isSetUp }
     });
   }, 'totp-config'));