v1.13.4: Standardize all route responses to use response helpers

Convert ~160 raw res.json()/res.status().json() calls across 32+ files
to use centralized helpers from src/utils/responses.js (ok, errorResponse,
successMessage, notFound, validationError, forbidden, unauthorized, conflict).

No behavior changes — response shapes are identical. Future schema changes
(e.g., requestId envelope) only need to update one module.

Fix error vs errorResponse signature mismatch in routes/health.js CA cert
endpoint where error(res, message, statusCode) was being called with
errorResponse(res, statusCode, message, extras) argument order.

Files changed: middleware.js, csrf-protection.js, error-handler.js,
license-manager.js, src/app.js, and 27 route files.

Test suite: 755 pass / 4 pre-existing failures (services credential tests).

dashcaddy-api/routes/ca.js

@@ -5,6 +5,7 @@ const path = require('path');
 const { execSync } = require('child_process');
 const { exists } = require('../fs-helpers');
 const { ValidationError } = require('../errors');
+const { ok } = require('../src/utils/responses');
 const platformPaths = require('../platform-paths');
 
 module.exports = function(ctx) {
@@ -26,8 +27,7 @@ module.exports = function(ctx) {
       const expirationDate = new Date(certInfo.validUntil);
       const daysUntilExpiration = Math.floor((expirationDate - new Date()) / (1000 * 60 * 60 * 24));
 
-      res.json({
-        success: true,
+      ok(res, {
         certificate: {
           name: certInfo.name,
           fingerprint: certInfo.fingerprint,
@@ -243,7 +243,7 @@ ${safeDomain.includes('.') ? `DNS.2 = *.${safeDomain}` : ''}`;
     const certsDir = platformPaths.generatedCertsDir;
 
     if (!await exists(certsDir)) {
-      return res.json({ success: true, certificates: [] });
+      return ok(res, { certificates: [] });
     }
 
     const dirEntries = await fsp.readdir(certsDir);
@@ -278,7 +278,7 @@ ${safeDomain.includes('.') ? `DNS.2 = *.${safeDomain}` : ''}`;
         }
       }))).filter(Boolean);
 
-    res.json({ success: true, certificates });
+    ok(res, { certificates });
   }, 'ca-certs'));
 
   return router;