v1.13.4: Standardize all route responses to use response helpers

Convert ~160 raw res.json()/res.status().json() calls across 32+ files
to use centralized helpers from src/utils/responses.js (ok, errorResponse,
successMessage, notFound, validationError, forbidden, unauthorized, conflict).

No behavior changes — response shapes are identical. Future schema changes
(e.g., requestId envelope) only need to update one module.

Fix error vs errorResponse signature mismatch in routes/health.js CA cert
endpoint where error(res, message, statusCode) was being called with
errorResponse(res, statusCode, message, extras) argument order.

Files changed: middleware.js, csrf-protection.js, error-handler.js,
license-manager.js, src/app.js, and 27 route files.

Test suite: 755 pass / 4 pre-existing failures (services credential tests).

dashcaddy-api/routes/browse.js

@@ -5,6 +5,7 @@ const path = require('path');
 const { exists, isAccessible } = require('../fs-helpers');
 const { paginate, parsePaginationParams } = require('../pagination');
 const { ValidationError, ForbiddenError } = require('../errors');
+const { ok } = require('../src/utils/responses');
 
 /**
  * Browse route factory
@@ -44,7 +45,7 @@ module.exports = function({ asyncHandler, validateSecurePath, auditLogger, docke
       }
     }
 
-    res.json({ success: true, roots });
+    return ok(res, { roots });
   }, 'browse-roots'));
 
   // Browse directory contents
@@ -64,7 +65,7 @@ module.exports = function({ asyncHandler, validateSecurePath, auditLogger, docke
           roots.push(r);
         }
       }
-      return res.json({ success: true, path: '', items: roots });
+      return ok(res, { path: '', items: roots });
     }
 
     const matchingRoot = BROWSE_ROOTS.find(r =>
@@ -124,8 +125,7 @@ module.exports = function({ asyncHandler, validateSecurePath, auditLogger, docke
 
     const paginationParams = parsePaginationParams(req.query);
     const result = paginate(folders, paginationParams);
-    res.json({
-      success: true,
+    ok(res, {
       path: requestedPath,
       parent: path.dirname(requestedPath).replace(/\\/g, '/') || null,
       items: result.data,
@@ -190,8 +190,7 @@ module.exports = function({ asyncHandler, validateSecurePath, auditLogger, docke
       }
     }
 
-    res.json({
-      success: true,
+    ok(res, {
       mounts: detectedMounts,
       message: detectedMounts.length > 0
         ? `Found ${detectedMounts.length} media mount(s) from existing containers`