fix(routes): convert alias-import + canonical-shape callsites to canonical errorResponse (DC-063) [glm-grade=A]

Background (DC-062, 2026-08-18, c01a011): errorResponse has TWO bindings in
src/utils/responses.js:
  - canonical: errorResponse(res, statusCode, message, extras) + DC-062 validator
  - alias: error(res, message, statusCode = 500) -- NO validator

DC-062 already fixed routes/caddy-upstreams.js and added a defensive
TypeError-throwing validator on the canonical path.

DC-063 (this commit): the same bug class lurks in 2 more route files that
import the alias 'error: errorResponse' but call it with the canonical
shape '(res, NUM, STRING)'. The alias function does NOT run the validator,
so at runtime the alias path silently fires
  res.status('event not found') -> TypeError -> 500 HTML panic
silently masking the intended 4xx JSON response for the client.

Affected files:
  - routes/security.js: 15 callsites (lines 110-251)
    Pre-fix every GET /events/:id (404), POST /events (400/409), PUT
    /events/batch (400/413), POST/PATCH/DELETE /hosts (400/404/409) all
    returned 500 HTML with a RangeError stack instead of the intended JSON.
    Fix: switched import to canonical so the existing canonical-shape
    callsites bind to the validator-armed function. 0 callsite changes.

  - routes/services.js: 7 callsites total
    3 already in canonical shape (POST /services credentials,
    lines 222/246/261) -- switched import fixes them.
    4 alias-shape callsites (lines 406/432/455/486) -- rewritten to
    canonical shape per responses.js:76.

Test sweep:
  - NEW __tests__/routes/errorresponse-arg-order.regression.test.js (284
    lines, 75 tests): pins
    (1) the validator (defense-in-depth) — 14 tests
    (2) the routes/ + src/utilities/ convention — 49 one-per-file
        static-tree walk that classifies each file's import style
        (alias vs canonical) and asserts each callsite matches the
        file's own convention.
    (3) live-HTTP smoke — security.js /events/:id + /hosts/:id return
        404 JSON, never 500 HTML.
    Also serves as the spec defining the alias-vs-canonical convention
    for any future contributor.

  - UPDATED __tests__/routes/services.routes.test.js: fixture mock for
    src/utils/responses now exposes both errorResponse (canonical) and
    error (alias) so the route's canonical-shape import resolves.
    29/29 tests still pass.

Verification: full suite 93/93 / 2114/2114 green; security.js + services.js
both fully canonical; 13 canonical-import files (DC-062 + DC-063) + 10
alias-import files (using message-first shape correctly) — proven
consistent by the static sweep.

GLM-5.3 stand-in judge round 1: GRADE=A (verified cold diff + convention
check + 4-tool-call budget); 2 LOW polish suggestions logged for a
follow-up DC: (a) require.cache injection in the live HTTP smoke
should migrate to jest.mock(virtual:true) so a module rename fails
loudly; (b) static sweep should assert a min-callsite floor per
convention class.

dashcaddy-api/__tests__/routes/errorresponse-arg-order.regression.test.js

@@ -0,0 +1,284 @@
+/**
+ * DC-063: errorResponse arg-order invariant regression suite.
+ *
+ * Three layers of correctness pinned by this test:
+ *
+ *   (1) The validator at responses.js:76-98 catches wrong-order callers
+ *       with a clear TypeError naming statusCode. Defense-in-depth: any
+ *       future swap is caught at the smallest possible blast radius
+ *       (one TypeError on the request thread) instead of an HTTP 500 HTML
+ *       panic for the operator and client.
+ *
+ *   (2) The static trees under dashcaddy-api/routes/ and
+ *       dashcaddy-api/src/utilities/ follow ONE of two equivalent
+ *       conventions consistently:
+ *
+ *          Convention A — canonical import `errorResponse` from responses.js.
+ *              Callsite shape: errorResponse(res, statusCode, message, extras?)
+ *              statusCode must be an integer 100..599; message must be a string.
+ *
+ *          Convention B — alias import `error: errorResponse` from responses.js,
+ *              which binds the local `errorResponse` to the message-first
+ *              helper `error(res, message, statusCode = 500)`.
+ *              Callsite shape: errorResponse(res, message, statusCode)
+ *
+ *       Mixing the alias-import with the canonical-shape callsite is the
+ *       DC-063 bug class: at runtime, the alias function fires
+ *       `res.status('event not found')` → TypeError → HTTP 500 HTML panic,
+ *       silently masking the intended 4xx JSON response for the client.
+ *       The validator at (1) does NOT help because the alias path skips it.
+ *
+ *   (3) End-to-end smoke for one of each fixed-file: live HTTP hits the
+ *       endpoint with the malformed input that triggers the fix-callsite
+ *       branch, and asserts the wire response is the expected 4xx JSON
+ *       (status + content-type + body) — never a 500 HTML panic.
+ *
+ * Origin (DC-062): shipped 2026-08-18 by Hermes loop. Found 4 callsites in
+ * routes/caddy-upstreams.js and added the validator.
+ *
+ * DC-063 (this file): extended the search across the routes tree with
+ * alias-import awareness. Found 18 instances of the alias-imported +
+ * canonical-shape callsite bug class in 2 files (security.js + 3 calls
+ * in services.js). Fixed by switching those imports to canonical and
+ * rewriting the remaining 4 alias-shape callsites in services.js to
+ * canonical-shape. Adding this regression test to prevent the same
+ * swap from being reintroduced in future route file edits.
+ */
+
+const path = require('path');
+const express = require('express');
+const http = require('http');
+const fs = require('fs');
+const glob = require('glob');
+
+const repoRoot = path.join(__dirname, '..', '..'); // dashcaddy-api/
+const { errorResponse, error: aliasError } = require(
+  path.join(repoRoot, 'src/utils/responses')
+);
+
+// ─── (1) Type validator (defense-in-depth) ────────────────────────────────
+describe('DC-063: errorResponse type validator (defense-in-depth)', () => {
+  function makeRes() {
+    return { status: () => makeRes(), json: () => makeRes() };
+  }
+
+  test('canonical (res, statusCode, message) does not throw and JSON is well-formed', () => {
+    expect(() => errorResponse(makeRes(), 400, 'Invalid level')).not.toThrow();
+    expect(() => errorResponse(makeRes(), 503, 'downstream unavailable', { code: 'DC-503' }))
+      .not.toThrow();
+  });
+
+  test('swapped canonical-shape throws TypeError naming statusCode', () => {
+    expect(() => errorResponse(makeRes(), 'msg-not-status', 400))
+      .toThrow(TypeError);
+    expect(() => errorResponse(makeRes(), 'msg-not-status', 400))
+      .toThrow(/statusCode must be an integer HTTP status \(100\.\.599\)/);
+  });
+
+  test.each([
+    [0, 'below range'],
+    [99, 'below range'],
+    [600, 'above range'],
+    [3.14, 'non-integer'],
+    [NaN, 'NaN'],
+    [Infinity, 'Infinity'],
+  ])('rejects numeric out-of-band statusCode %p (%s)', (bad) => {
+    expect(() => errorResponse(makeRes(), bad, 'msg')).toThrow(TypeError);
+  });
+
+  test('rejects non-string message', () => {
+    expect(() => errorResponse(makeRes(), 400, 42)).toThrow(TypeError);
+    expect(() => errorResponse(makeRes(), 400, null)).toThrow(TypeError);
+    expect(() => errorResponse(makeRes(), 400, { err: 'oops' })).toThrow(TypeError);
+  });
+
+  test('extras object merges into body and surfaces top-level code (DC-086)', () => {
+    const captured = {};
+    const res = {
+      status(c) { captured.status = c; return res; },
+      json(b)   { captured.body = b; return res; },
+    };
+    errorResponse(res, 400, 'Invalid input', { code: 'DC-400', field: 'level' });
+    expect(captured.status).toBe(400);
+    expect(captured.body).toEqual({
+      success: false,
+      error: 'Invalid input',
+      field: 'level',
+      code: 'DC-400',
+    });
+  });
+
+  test('alias error(res, message, statusCode) still works for backward-compat', () => {
+    expect(() => aliasError(makeRes(), 'msg', 400)).not.toThrow();
+  });
+});
+
+// ─── (2) Static tree: every callsite follows its file's imported convention ─
+describe('DC-063: routes/ + utilities/ arg-order matches each file\'s import', () => {
+  function isNumericLiteral(s) {
+    return /^\d+$/.test(s);
+  }
+  function isExpressionReturningNumber(s) {
+    return /^(err|error|response)\.status(Code)?\s*\|\|.*\d+/.test(s) ||
+           /^response\.status$/.test(s);
+  }
+  function isStringy(s) {
+    s = s.trim();
+    if (s.startsWith('"') || s.startsWith("'") || s.startsWith('`')) return true;
+    if (/^[a-zA-Z_][a-zA-Z_0-9]*\([^)]*\)$/.test(s)) return true;            // safeErrorMessage(err)
+    if (/^[a-zA-Z_][a-zA-Z_0-9]*\.[a-zA-Z_][a-zA-Z_0-9.]*$/.test(s)) return true; // err.message
+    return false;
+  }
+  function isNumeric(s) {
+    return isNumericLiteral(s.trim()) || isExpressionReturningNumber(s.trim());
+  }
+  // Match `errorResponse(res, ARG1, ARG2)` (allow extras after).
+  const pat = /errorResponse\(\s*res\s*,\s*([^,]+?)\s*,\s*([^,)\s]+)(?:\s*,|\s*\))/g;
+
+  const ROUTES = glob.sync('routes/*.js', { cwd: repoRoot });
+  const UTILS = glob.sync('src/utilities/*.js', { cwd: repoRoot });
+  const ALL = [...ROUTES, ...UTILS];
+
+  function classifyFile(src) {
+    // Filter comments before classification (the comment can mention the alias).
+    const codeOnly = src.split('\n')
+      .filter((l) => !l.trim().startsWith('//') && !l.trim().startsWith('*') && !l.trim().startsWith('/*'))
+      .join('\n');
+    const is_alias = /\berror:\s*errorResponse\b/.test(codeOnly);
+    return { is_alias };
+  }
+
+  test.each(ALL.map((rel) => [rel]))('%s has consistent callsite shape', (rel) => {
+    const abs = path.join(repoRoot, rel);
+    const src = fs.readFileSync(abs, 'utf8');
+    const { is_alias } = classifyFile(src);
+    const bad = [];
+    for (const m of src.matchAll(pat)) {
+      const a1 = m[1].trim();
+      const a2 = m[2].trim();
+      const lineNo = src.slice(0, m.index).split('\n').length;
+
+      if (is_alias) {
+        // Convention B: arg1 = message (string), arg2 = status (number)
+        if (isNumeric(a1) && isStringy(a2)) {
+          bad.push({ lineNo, a1, a2, reason: 'alias-import + canonical-shape (BUG: alias path skips validator)' });
+        }
+      } else {
+        // Convention A: arg1 = status (number), arg2 = message (string)
+        if (isStringy(a1) && isNumeric(a2)) {
+          bad.push({ lineNo, a1, a2, reason: 'canonical-import + alias-shape (BUG: validator fires TypeError -> 500 HTML)' });
+        }
+      }
+    }
+    if (bad.length) {
+      throw new Error(
+        `${rel}: ${bad.length} inconsistent callsite(s):\n` +
+        bad.map((b) => `  L${b.lineNo}: (${b.a1}, ${b.a2}) — ${b.reason}`).join('\n')
+      );
+    }
+  });
+});
+
+// ─── (3) End-to-end HTTP smoke — invalid input returns the expected JSON ─
+describe('DC-063: live HTTP smoke — security.js GET /events/:id returns 404 JSON (not 500)', () => {
+  let server, baseUrl;
+
+  beforeAll(() => {
+    process.env.NODE_ENV = 'test';
+    process.env.DASHCADDY_API_TOKEN = process.env.DASHCADDY_API_TOKEN || 'test-token';
+    process.env.DASHCADDY_ENCRYPTION_KEY = process.env.DASHCADDY_ENCRYPTION_KEY || 'k'.repeat(64);
+    process.env.JWT_SECRET = process.env.JWT_SECRET || 'jwt-test-secret-32-chars-minimum-len';
+
+    const app = express();
+    app.use(express.json());
+
+    // Auth shim — bypass host authentication middleware.
+    app.use((_req, _res, next) => next());
+
+    // Shim the security event store with a fake.
+    const fakeStore = {
+      get: () => null,
+      append: () => ({ id: 'fake', accepted: true }),
+      list: () => ({ events: [], total: 0 }),
+      query: () => ({ events: [], total: 0 }),
+    };
+    const fakeRegistry = {
+      list: () => [],
+      register: () => ({ host: {}, api_key: 'x' }),
+      get: () => null,
+      update: () => null,
+      remove: () => true,
+      setEnabled: () => true,
+      authHostByApiKey: () => null,
+      authHostByBearer: () => null,
+    };
+
+    // Inject store + registry via a require-cache swap so security.js's
+    // getStore()/getRegistry() return our fakes.
+    require.cache[path.join(repoRoot, 'src/security/event-store')] = {
+      exports: { getStore: () => fakeStore },
+      id: 'fake-event-store', filename: 'fake', loaded: true,
+    };
+    require.cache[path.join(repoRoot, 'src/security/host-registry')] = {
+      exports: { getRegistry: () => fakeRegistry },
+      id: 'fake-host-registry', filename: 'fake', loaded: true,
+    };
+    // platform-paths is required by security.js — provide a minimal shim.
+    require.cache[path.join(repoRoot, 'platform-paths')] = {
+      exports: { configFile: () => '/tmp/x', dataFile: () => '/tmp/y' },
+      id: 'fake-platform-paths', filename: 'fake', loaded: true,
+    };
+
+    const securityRoutes = require(path.join(repoRoot, 'routes/security'));
+    app.use((req, res, next) => {
+      res.success = (data) => res.json({ success: true, ...data });
+      res.errorResponse = (status, msg, extras) => errorResponse(res, status, msg, extras);
+      res.ok = (data) => res.json({ success: true, ...data });
+      next();
+    });
+    app.use('/api/security', securityRoutes({
+      store: fakeStore,
+      registry: fakeRegistry,
+      log: { info: () => {}, warn: () => {}, error: () => {}, debug: () => {} },
+    }));
+
+    server = http.createServer(app).listen(0);
+    // .listen(0) synchronously assigns a port; no need to wait.
+    baseUrl = `http://127.0.0.1:${server.address().port}`;
+  });
+
+  afterAll((done) => {
+    if (server && server.listening) server.close(done);
+    else done();
+  });
+
+  function get(p) {
+    return new Promise((resolve, reject) => {
+      http.get(`${baseUrl}${p}`, (resp) => {
+        let buf = '';
+        resp.on('data', (c) => { buf += c; });
+        resp.on('end', () => resolve({
+          status: resp.statusCode,
+          body: buf,
+          contentType: resp.headers['content-type'] || '',
+        }));
+      }).on('error', reject);
+    });
+  }
+
+  test('GET /api/security/events/nonexistent — pre-fix crashed with 500 HTML, post-fix returns 404 JSON', async () => {
+    const r = await get('/api/security/events/nonexistent');
+    expect(r.status).toBe(404);
+    expect(r.contentType).toMatch(/application\/json/);
+    expect(r.body).toMatch(/event not found/i);
+    expect(r.body).not.toMatch(/<html|<!DOCTYPE|stack/i); // NOT an HTML panic
+  });
+
+  test('GET /api/security/hosts/nonexistent — pre-fix crashed with 500 HTML, post-fix returns 404 JSON', async () => {
+    const r = await get('/api/security/hosts/nonexistent');
+    expect(r.status).toBe(404);
+    expect(r.contentType).toMatch(/application\/json/);
+    expect(r.body).toMatch(/host not found/i);
+    expect(r.body).not.toMatch(/<html|<!DOCTYPE|stack/i);
+  });
+});