[grade=B] api: fix undeclared 'format' runtime bug in routes/ca.js + 10 lint errors

- routes/ca.js: declare format before pfx/pem/crt dispatch (was ReferenceError
  on every request that passed validation); add CA_CERT_FORMATS single source
  of truth + hardened format extraction (string-coerce, whitelist)
- routes/caddycode.js: fix upstream-validation regexes (control-char classes)
- routes/logs.js: SSE/validation lint fixes
- routes/openclaw.js: remove useless regex escape in ALLOWED_PATH_RE
- fleet-validation.js + http-caddy-admin-origin test: eslint-disable for
  intentional control-regex security sentinels
- ca-dc076.routes.test.js: regression test for declared format + behavioral
  coverage of format validation (now pre-PKI)

Judge: Qwen lane (qwen3.8-max) grade B, 0 blocking, verdict
/tmp/judge-batch1-verdict.json. API suite 2859/2859 green.

dashcaddy-api/routes/logs.js

@@ -270,14 +270,10 @@ module.exports = function({ asyncHandler, ok, docker, logDigest, dockerMaintenan
     // can't change statusCode. The reader does the same validation but
     // we want to short-circuit here so the response status reflects the
     // right category (400 for validation, 503 for bind-mount missing).
-    try {
-      journald.assertUnitAllowed(req.query.unit);
-      if (req.query.since) journald.parseTimestamp(req.query.since, 'since');
-    } catch (err) {
-      // Pass through the global error middleware so the response status
-      // + shape matches every other validation error in the API.
-      throw err;
-    }
+    // Throws pass straight to the global error middleware so the response
+    // status + shape matches every other validation error in the API.
+    journald.assertUnitAllowed(req.query.unit);
+    if (req.query.since) journald.parseTimestamp(req.query.since, 'since');
 
     // SSE headers — same convention as /logs/stream/:id.
     res.setHeader('Content-Type', 'text/event-stream');