[grade=B] api: fix undeclared 'format' runtime bug in routes/ca.js + 10 lint errors

- routes/ca.js: declare format before pfx/pem/crt dispatch (was ReferenceError
  on every request that passed validation); add CA_CERT_FORMATS single source
  of truth + hardened format extraction (string-coerce, whitelist)
- routes/caddycode.js: fix upstream-validation regexes (control-char classes)
- routes/logs.js: SSE/validation lint fixes
- routes/openclaw.js: remove useless regex escape in ALLOWED_PATH_RE
- fleet-validation.js + http-caddy-admin-origin test: eslint-disable for
  intentional control-regex security sentinels
- ca-dc076.routes.test.js: regression test for declared format + behavioral
  coverage of format validation (now pre-PKI)

Judge: Qwen lane (qwen3.8-max) grade B, 0 blocking, verdict
/tmp/judge-batch1-verdict.json. API suite 2859/2859 green.

dashcaddy-api/routes/caddycode.js

@@ -64,8 +64,8 @@ function validateGenerationConfig(config) {
   //    reverse_proxy upstreams). Two regex branches: (a) bare host with
   //    required :port, (b) bracketed IPv6 literal with required :port.
   if (typeof upstream !== 'string'
-      || !/^[a-z0-9.\-]+:\d{1,5}$/i.test(upstream)
-      && !/^\[[a-z0-9.\-:.]+\]:\d{1,5}$/i.test(upstream)
+      || !/^[a-z0-9.-]+:\d{1,5}$/i.test(upstream)
+      && !/^\[[a-z0-9.:.-]+\]:\d{1,5}$/i.test(upstream)
   ) {
     errors.push('upstream must be host:port (host letters/digits/dots/hyphens, port 1-65535, optional IPv6 brackets)');
   }