Migrate codebase from CommonJS to ES Modules

- Convert all require()/module.exports to import/export across 260+ files
- Add "type": "module" to package.json to enable ESM by default
- Add migrations/package.json with "type": "commonjs" to keep db-migrate compatible
- Convert eslint.config.js to ESM with sourceType: "module"
- Replace __dirname/__filename with import.meta.dirname/import.meta.filename
- Replace require.main === module with process.argv[1] === import.meta.filename
- Remove 'use strict' directives (implicit in ESM)
- Convert dynamic require() in switch statements to static import lookup maps
  (dns.js, domains.js, backupformats.js, backupsites.js, network.js)
- Extract self-referencing exports.CONSTANT patterns into standalone const
  declarations (apps.js, services.js, locks.js, users.js, mail.js, etc.)
- Lazify SERVICES object in services.js to avoid circular dependency TDZ issues
- Add clearMailQueue() to mailer.js for ESM-safe queue clearing in tests
- Add _setMockApp() to ldapserver.js for ESM-safe test mocking
- Add _setMockResolve() wrapper to dig.js for ESM-safe DNS mocking in tests
- Convert backupupload.js to use dynamic imports so --check exits before
  loading the module graph (which requires BOX_ENV)
- Update check-install to use ESM import for infra_version.js
- Convert scripts/ (hotfix, release, remote_hotfix.js, find-unused-translations)
- All 1315 tests passing

Migration stats (AI-assisted using Cursor with Claude):
- Wall clock time: ~3-4 hours
- Assistant completions: ~80-100
- Estimated token usage: ~1-2M tokens

Co-authored-by: Cursor <cursoragent@cursor.com>

src/eventlog.js

@@ -1,6 +1,19 @@
-'use strict';
+import assert from 'node:assert';
+import crypto from 'node:crypto';
+import * as database from './database.js';
+import debugModule from 'debug';
+import mysql from 'mysql2';
+import * as notifications from './notifications.js';
+import safe from 'safetydance';
 
-exports = module.exports = {
+const debug = debugModule('box:eventlog');
+
+const ACTION_ACTIVATE = 'cloudron.activate';
+const ACTION_USER_LOGIN = 'user.login';
+const ACTION_USER_LOGIN_GHOST = 'user.login.ghost';
+const ACTION_USER_LOGOUT = 'user.logout';
+
+export default {
     add,
     upsertLoginEvent,
     get,
@@ -10,7 +23,7 @@ exports = module.exports = {
     _clear: clear,
 
     // keep in sync with webadmin index.js filter
-    ACTION_ACTIVATE: 'cloudron.activate',
+    ACTION_ACTIVATE,
     ACTION_APP_CLONE: 'app.clone',
     ACTION_APP_CONFIGURE: 'app.configure',
     ACTION_APP_REPAIR: 'app.repair',
@@ -96,9 +109,9 @@ exports = module.exports = {
     ACTION_UPDATE_FINISH: 'cloudron.update.finish',
 
     ACTION_USER_ADD: 'user.add',
-    ACTION_USER_LOGIN: 'user.login',
-    ACTION_USER_LOGIN_GHOST: 'user.login.ghost',
-    ACTION_USER_LOGOUT: 'user.logout',
+    ACTION_USER_LOGIN,
+    ACTION_USER_LOGIN_GHOST,
+    ACTION_USER_LOGOUT,
     ACTION_USER_REMOVE: 'user.remove',
     ACTION_USER_UPDATE: 'user.update',
     ACTION_USER_TRANSFER: 'user.transfer',
@@ -118,14 +131,6 @@ exports = module.exports = {
     ACTION_PROCESS_CRASH: 'system.crash' // obsolete
 };
 
-const assert = require('node:assert'),
-    crypto = require('node:crypto'),
-    database = require('./database.js'),
-    debug = require('debug')('box:eventlog'),
-    mysql = require('mysql2'),
-    notifications = require('./notifications.js'),
-    safe = require('safetydance');
-
 const EVENTLOG_FIELDS = [ 'id', 'action', 'sourceJson', 'dataJson', 'creationTime' ].join(',');
 
 function postProcess(record) {
@@ -182,7 +187,7 @@ async function get(id) {
 }
 
 async function getActivationEvent() {
-    const result = await database.query(`SELECT ${EVENTLOG_FIELDS} FROM eventlog WHERE action = ? ORDER BY creationTime`, [ exports.ACTION_ACTIVATE ]);
+    const result = await database.query(`SELECT ${EVENTLOG_FIELDS} FROM eventlog WHERE action = ? ORDER BY creationTime`, [ ACTION_ACTIVATE ]);
     if (result.length === 0) return null;
 
     return postProcess(result[0]);
@@ -225,9 +230,9 @@ async function cleanup(options) {
 
     // only these actions are pruned
     const actions = [
-        exports.ACTION_USER_LOGIN,
-        exports.ACTION_USER_LOGIN_GHOST,
-        exports.ACTION_USER_LOGOUT,
+        ACTION_USER_LOGIN,
+        ACTION_USER_LOGIN_GHOST,
+        ACTION_USER_LOGOUT,
     ];
 
     let query = `SELECT ${EVENTLOG_FIELDS} FROM eventlog WHERE creationTime <= ? AND (`;