v1.13.4: Standardize all route responses to use response helpers

Convert ~160 raw res.json()/res.status().json() calls across 32+ files
to use centralized helpers from src/utils/responses.js (ok, errorResponse,
successMessage, notFound, validationError, forbidden, unauthorized, conflict).

No behavior changes — response shapes are identical. Future schema changes
(e.g., requestId envelope) only need to update one module.

Fix error vs errorResponse signature mismatch in routes/health.js CA cert
endpoint where error(res, message, statusCode) was being called with
errorResponse(res, statusCode, message, extras) argument order.

Files changed: middleware.js, csrf-protection.js, error-handler.js,
license-manager.js, src/app.js, and 27 route files.

Test suite: 755 pass / 4 pre-existing failures (services credential tests).

dashcaddy-api/routes/recipes/index.js

@@ -2,6 +2,7 @@ const express = require('express');
 const deployRoutes = require('./deploy');
 const manageRoutes = require('./manage');
 const { NotFoundError } = require('../../errors');
+const { ok } = require('../../src/utils/responses');
 
 /**
  * Recipes routes aggregator
@@ -55,7 +56,7 @@ module.exports = function(ctx) {
       setupInstructions: recipe.setupInstructions
     }));
 
-    res.json({ success: true, templates, categories: RECIPE_CATEGORIES });
+    ok(res, { templates, categories: RECIPE_CATEGORIES });
   }, 'recipe-templates'));
 
   // GET /api/recipes/templates/:recipeId — get single recipe template detail
@@ -64,7 +65,7 @@ module.exports = function(ctx) {
     const recipe = RECIPE_TEMPLATES[req.params.recipeId];
     if (!recipe) throw new NotFoundError(`Recipe template ${req.params.recipeId}`);
 
-    res.json({ success: true, recipe: { id: req.params.recipeId, ...recipe } });
+    ok(res, { recipe: { id: req.params.recipeId, ...recipe } });
   }, 'recipe-template-detail'));
 
   // Mount deploy and manage sub-routes — pass full ctx for sub-routes that reference ctx.*