[grade=B] api: fix undeclared 'format' runtime bug in routes/ca.js + 10 lint errors

- routes/ca.js: declare format before pfx/pem/crt dispatch (was ReferenceError
  on every request that passed validation); add CA_CERT_FORMATS single source
  of truth + hardened format extraction (string-coerce, whitelist)
- routes/caddycode.js: fix upstream-validation regexes (control-char classes)
- routes/logs.js: SSE/validation lint fixes
- routes/openclaw.js: remove useless regex escape in ALLOWED_PATH_RE
- fleet-validation.js + http-caddy-admin-origin test: eslint-disable for
  intentional control-regex security sentinels
- ca-dc076.routes.test.js: regression test for declared format + behavioral
  coverage of format validation (now pre-PKI)

Judge: Qwen lane (qwen3.8-max) grade B, 0 blocking, verdict
/tmp/judge-batch1-verdict.json. API suite 2859/2859 green.

dashcaddy-api/src/utilities/fleet-validation.js

@@ -300,6 +300,7 @@ function validateFleetHost(input) {
   }
   // Disallow control chars in name (newlines would let a stored name break
   // log-file formats and could enable log injection if not properly escaped).
+  // eslint-disable-next-line no-control-regex -- intentionally matching control chars
   if (/[\x00-\x1f]/.test(name)) {
     return {
       ok: false,
@@ -394,6 +395,7 @@ function validateFleetHost(input) {
           message: 'each tag must be a string of 1..50 characters',
         };
       }
+      // eslint-disable-next-line no-control-regex -- intentionally matching control chars
       if (/[\x00-\x1f]/.test(t)) {
         return {
           ok: false,