Migrate codebase from CommonJS to ES Modules

- Convert all require()/module.exports to import/export across 260+ files
- Add "type": "module" to package.json to enable ESM by default
- Add migrations/package.json with "type": "commonjs" to keep db-migrate compatible
- Convert eslint.config.js to ESM with sourceType: "module"
- Replace __dirname/__filename with import.meta.dirname/import.meta.filename
- Replace require.main === module with process.argv[1] === import.meta.filename
- Remove 'use strict' directives (implicit in ESM)
- Convert dynamic require() in switch statements to static import lookup maps
  (dns.js, domains.js, backupformats.js, backupsites.js, network.js)
- Extract self-referencing exports.CONSTANT patterns into standalone const
  declarations (apps.js, services.js, locks.js, users.js, mail.js, etc.)
- Lazify SERVICES object in services.js to avoid circular dependency TDZ issues
- Add clearMailQueue() to mailer.js for ESM-safe queue clearing in tests
- Add _setMockApp() to ldapserver.js for ESM-safe test mocking
- Add _setMockResolve() wrapper to dig.js for ESM-safe DNS mocking in tests
- Convert backupupload.js to use dynamic imports so --check exits before
  loading the module graph (which requires BOX_ENV)
- Update check-install to use ESM import for infra_version.js
- Convert scripts/ (hotfix, release, remote_hotfix.js, find-unused-translations)
- All 1315 tests passing

Migration stats (AI-assisted using Cursor with Claude):
- Wall clock time: ~3-4 hours
- Assistant completions: ~80-100
- Estimated token usage: ~1-2M tokens

Co-authored-by: Cursor <cursoragent@cursor.com>

src/backups.js

@@ -1,6 +1,18 @@
-'use strict';
+import assert from 'node:assert';
+import BoxError from './boxerror.js';
+import * as database from './database.js';
+import debugModule from 'debug';
+import eventlog from './eventlog.js';
+import hat from './hat.js';
+import safe from 'safetydance';
+import tasks from './tasks.js';
 
-exports = module.exports = {
+const debug = debugModule('box:backups');
+
+const BACKUP_TYPE_APP = 'app';
+const BACKUP_STATE_NORMAL = 'normal';
+
+export default {
     get,
     getByIdentifierAndStatePaged,
     getLatestInTargetByIdentifier, // brutal function name
@@ -19,24 +31,15 @@ exports = module.exports = {
     BACKUP_IDENTIFIER_BOX: 'box',
     BACKUP_IDENTIFIER_MAIL: 'mail',
 
-    BACKUP_TYPE_APP: 'app',
+    BACKUP_TYPE_APP,
     BACKUP_TYPE_BOX: 'box',
     BACKUP_TYPE_MAIL: 'mail',
 
-    BACKUP_STATE_NORMAL: 'normal', // should rename to created to avoid listing in UI?
+    BACKUP_STATE_NORMAL,
     BACKUP_STATE_CREATING: 'creating',
     BACKUP_STATE_ERROR: 'error',
 };
 
-const assert = require('node:assert'),
-    BoxError = require('./boxerror.js'),
-    database = require('./database.js'),
-    debug = require('debug')('box:backups'),
-    eventlog = require('./eventlog.js'),
-    hat = require('./hat.js'),
-    safe = require('safetydance'),
-    tasks = require('./tasks.js');
-
 const BACKUPS_FIELDS = [ 'id', 'remotePath', 'label', 'identifier', 'creationTime', 'packageVersion', 'type', 'integrityJson',
     'statsJson', 'dependsOnJson', 'state', 'manifestJson', 'preserveSecs', 'encryptionVersion', 'appConfigJson', 'siteId',
     'integrityCheckTaskId', 'lastIntegrityCheckTime', 'integrityCheckStatus', 'integrityCheckResultJson' ].join(',');
@@ -85,7 +88,7 @@ async function add(data) {
 
     const creationTime = data.creationTime || new Date(); // allow tests to set the time
     const manifestJson = JSON.stringify(data.manifest);
-    const prefixId = data.type === exports.BACKUP_TYPE_APP ? `${data.type}_${data.identifier}` : data.type; // type and identifier are same for other types
+    const prefixId = data.type === BACKUP_TYPE_APP ? `${data.type}_${data.identifier}` : data.type; // type and identifier are same for other types
     const id = `${prefixId}_v${data.packageVersion}_${hat(32)}`; // id is used by the UI to derive dependent packages. making this a UUID will require a lot of db querying
     const appConfigJson = data.appConfig ? JSON.stringify(data.appConfig) : null;
     const statsJson = data.stats ? JSON.stringify(data.stats) : null;
@@ -117,7 +120,7 @@ async function getLatestInTargetByIdentifier(identifier, siteId) {
     assert.strictEqual(typeof identifier, 'string');
     assert.strictEqual(typeof siteId, 'string');
 
-    const results = await database.query(`SELECT ${BACKUPS_FIELDS} FROM backups WHERE identifier = ? AND state = ? AND siteId = ? LIMIT 1`, [ identifier, exports.BACKUP_STATE_NORMAL, siteId ]);
+    const results = await database.query(`SELECT ${BACKUPS_FIELDS} FROM backups WHERE identifier = ? AND state = ? AND siteId = ? LIMIT 1`, [ identifier, BACKUP_STATE_NORMAL, siteId ]);
     if (!results.length) return null;
     return postProcess(results[0]);
 }