Migrate codebase from CommonJS to ES Modules

- Convert all require()/module.exports to import/export across 260+ files
- Add "type": "module" to package.json to enable ESM by default
- Add migrations/package.json with "type": "commonjs" to keep db-migrate compatible
- Convert eslint.config.js to ESM with sourceType: "module"
- Replace __dirname/__filename with import.meta.dirname/import.meta.filename
- Replace require.main === module with process.argv[1] === import.meta.filename
- Remove 'use strict' directives (implicit in ESM)
- Convert dynamic require() in switch statements to static import lookup maps
  (dns.js, domains.js, backupformats.js, backupsites.js, network.js)
- Extract self-referencing exports.CONSTANT patterns into standalone const
  declarations (apps.js, services.js, locks.js, users.js, mail.js, etc.)
- Lazify SERVICES object in services.js to avoid circular dependency TDZ issues
- Add clearMailQueue() to mailer.js for ESM-safe queue clearing in tests
- Add _setMockApp() to ldapserver.js for ESM-safe test mocking
- Add _setMockResolve() wrapper to dig.js for ESM-safe DNS mocking in tests
- Convert backupupload.js to use dynamic imports so --check exits before
  loading the module graph (which requires BOX_ENV)
- Update check-install to use ESM import for infra_version.js
- Convert scripts/ (hotfix, release, remote_hotfix.js, find-unused-translations)
- All 1315 tests passing

Migration stats (AI-assisted using Cursor with Claude):
- Wall clock time: ~3-4 hours
- Assistant completions: ~80-100
- Estimated token usage: ~1-2M tokens

Co-authored-by: Cursor <cursoragent@cursor.com>

src/blobs.js

@@ -1,8 +1,12 @@
 /* jslint node:true */
 
-'use strict';
+import assert from 'node:assert';
+import * as database from './database.js';
 
-exports = module.exports = {
+const CERT_PREFIX = 'cert';
+const CERT_SUFFIX = 'cert';
+
+export default {
     get,
     getString,
     set,
@@ -25,15 +29,11 @@ exports = module.exports = {
     OIDC_KEY_EDDSA: 'oidc_key_eddsa', // this is only JWT private key, the public key will be derived
     OIDC_KEY_RS256: 'oidc_key_rs256',
 
-    CERT_PREFIX: 'cert',
-    CERT_SUFFIX: 'cert',
-
+    CERT_PREFIX,
+    CERT_SUFFIX,
     _clear: clear
 };
 
-const assert = require('node:assert'),
-    database = require('./database.js');
-
 const BLOBS_FIELDS = [ 'id', 'value' ].join(',');
 
 async function get(id) {
@@ -75,6 +75,6 @@ async function clear() {
 }
 
 async function listCertIds() {
-    const result = await database.query('SELECT id FROM blobs WHERE id LIKE ?', [ `${exports.CERT_PREFIX}-%.${exports.CERT_SUFFIX}` ]);
+    const result = await database.query('SELECT id FROM blobs WHERE id LIKE ?', [ `${CERT_PREFIX}-%.${CERT_SUFFIX}` ]);
     return result.map(r => r.id);
 }