v1.13.4: Standardize all route responses to use response helpers

Convert ~160 raw res.json()/res.status().json() calls across 32+ files
to use centralized helpers from src/utils/responses.js (ok, errorResponse,
successMessage, notFound, validationError, forbidden, unauthorized, conflict).

No behavior changes — response shapes are identical. Future schema changes
(e.g., requestId envelope) only need to update one module.

Fix error vs errorResponse signature mismatch in routes/health.js CA cert
endpoint where error(res, message, statusCode) was being called with
errorResponse(res, statusCode, message, extras) argument order.

Files changed: middleware.js, csrf-protection.js, error-handler.js,
license-manager.js, src/app.js, and 27 route files.

Test suite: 755 pass / 4 pre-existing failures (services credential tests).

dashcaddy-api/routes/services.js

@@ -356,9 +356,11 @@ module.exports = function({
   }, 'services-status'));
 
   // List all services
+  // Always returns the standard envelope. The `services` field is the array
+  // (paginated if ?page=N&limit=M is in the query, otherwise the full list).
   router.get('/services', asyncHandler(async (req, res) => {
     if (!await exists(SERVICES_FILE)) {
-      return res.json([]);
+      return success(res, { services: [] });
     }
     const services = await servicesStateManager.read();
     const paginationParams = parsePaginationParams(req.query);
@@ -366,7 +368,7 @@ module.exports = function({
     if (paginationParams) {
       success(res, { services: result.data, pagination: result.pagination });
     } else {
-      res.json(result.data);
+      success(res, { services: result.data });
     }
   }, 'services-list'));