v1.13.4: Standardize all route responses to use response helpers

Convert ~160 raw res.json()/res.status().json() calls across 32+ files
to use centralized helpers from src/utils/responses.js (ok, errorResponse,
successMessage, notFound, validationError, forbidden, unauthorized, conflict).

No behavior changes — response shapes are identical. Future schema changes
(e.g., requestId envelope) only need to update one module.

Fix error vs errorResponse signature mismatch in routes/health.js CA cert
endpoint where error(res, message, statusCode) was being called with
errorResponse(res, statusCode, message, extras) argument order.

Files changed: middleware.js, csrf-protection.js, error-handler.js,
license-manager.js, src/app.js, and 27 route files.

Test suite: 755 pass / 4 pre-existing failures (services credential tests).

dashcaddy-api/src/app.js

@@ -404,8 +404,7 @@ async function createApp() {
     appName = pkg.name || appName;
   } catch { /* package.json unreadable — keep fallback */ }
   apiRouter.get('/version', (req, res) => {
-    res.json({
-      success: true,
+    ok(res, {
       name: appName,
       version: appVersion,
       node: process.version,
@@ -608,15 +607,15 @@ async function createApp() {
 
   // Inline API routes
   apiRouter.get('/health', (req, res) => {
-    res.json({ status: 'ok', timestamp: new Date().toISOString() });
+    ok(res, { status: 'ok', timestamp: new Date().toISOString() });
   });
   
   apiRouter.get('/csrf-token', (req, res) => {
-    res.json({ success: true, token: req.csrfToken, headerName: CSRF_HEADER_NAME });
+    ok(res, { token: req.csrfToken, headerName: CSRF_HEADER_NAME });
   });
   
   apiRouter.get('/metrics', (req, res) => {
-    res.json({ success: true, metrics: metrics.getSummary() });
+    ok(res, { metrics: metrics.getSummary() });
   });
 
   // Mount at /api/v1 (canonical, single version)
@@ -624,7 +623,7 @@ async function createApp() {
 
   // Root-level health check
   app.get('/health', (req, res) => {
-    res.json({ status: 'ok', timestamp: new Date().toISOString() });
+    ok(res, { status: 'ok', timestamp: new Date().toISOString() });
   });
 
   // Liveness probe — "is the process alive?"
@@ -632,7 +631,7 @@ async function createApp() {
   // Used by k8s/Docker to decide whether to RESTART the container.
   // DO NOT add dependency checks here — those belong in /health/ready.
   app.get('/health/live', (req, res) => {
-    res.json({ status: 'alive', uptime: process.uptime() });
+    ok(res, { status: 'alive', uptime: process.uptime() });
   });
 
   // Readiness probe — "is the app ready to serve traffic?"
@@ -704,7 +703,7 @@ async function createApp() {
       timestamp: new Date().toISOString(),
       checks
     };
-    res.status(allOk ? 200 : 503).json(body);
+    ok(res, body, allOk ? 200 : 503);
   }));
 
   // Lightweight probe endpoint
@@ -830,7 +829,7 @@ async function createApp() {
         }
       }
 
-      res.json(result);
+      ok(res, result);
     } catch (error) {
       errorResponse(res, 500, safeErrorMessage(error));
     }