v1.13.4: Standardize all route responses to use response helpers

Convert ~160 raw res.json()/res.status().json() calls across 32+ files
to use centralized helpers from src/utils/responses.js (ok, errorResponse,
successMessage, notFound, validationError, forbidden, unauthorized, conflict).

No behavior changes — response shapes are identical. Future schema changes
(e.g., requestId envelope) only need to update one module.

Fix error vs errorResponse signature mismatch in routes/health.js CA cert
endpoint where error(res, message, statusCode) was being called with
errorResponse(res, statusCode, message, extras) argument order.

Files changed: middleware.js, csrf-protection.js, error-handler.js,
license-manager.js, src/app.js, and 27 route files.

Test suite: 755 pass / 4 pre-existing failures (services credential tests).

status/js/core/grid.js

@@ -65,7 +65,9 @@
       if (window.SkeletonLoader) window.SkeletonLoader.show(6);
       const response = await fetch('/api/v1/services', { cache: 'no-store' });
       if (response.ok) {
-        window.APPS = await response.json();
+        const result = await response.json();
+        // Standard envelope: { success: true, services: [...], pagination?: {...} }
+        window.APPS = result.services || [];
         if (window.SkeletonLoader) window.SkeletonLoader.hide();
       } else {
         console.error('Failed to load services:', response.status);