Migrate codebase from CommonJS to ES Modules

- Convert all require()/module.exports to import/export across 260+ files
- Add "type": "module" to package.json to enable ESM by default
- Add migrations/package.json with "type": "commonjs" to keep db-migrate compatible
- Convert eslint.config.js to ESM with sourceType: "module"
- Replace __dirname/__filename with import.meta.dirname/import.meta.filename
- Replace require.main === module with process.argv[1] === import.meta.filename
- Remove 'use strict' directives (implicit in ESM)
- Convert dynamic require() in switch statements to static import lookup maps
  (dns.js, domains.js, backupformats.js, backupsites.js, network.js)
- Extract self-referencing exports.CONSTANT patterns into standalone const
  declarations (apps.js, services.js, locks.js, users.js, mail.js, etc.)
- Lazify SERVICES object in services.js to avoid circular dependency TDZ issues
- Add clearMailQueue() to mailer.js for ESM-safe queue clearing in tests
- Add _setMockApp() to ldapserver.js for ESM-safe test mocking
- Add _setMockResolve() wrapper to dig.js for ESM-safe DNS mocking in tests
- Convert backupupload.js to use dynamic imports so --check exits before
  loading the module graph (which requires BOX_ENV)
- Update check-install to use ESM import for infra_version.js
- Convert scripts/ (hotfix, release, remote_hotfix.js, find-unused-translations)
- All 1315 tests passing

Migration stats (AI-assisted using Cursor with Claude):
- Wall clock time: ~3-4 hours
- Assistant completions: ~80-100
- Estimated token usage: ~1-2M tokens

Co-authored-by: Cursor <cursoragent@cursor.com>

src/locks.js

@@ -1,6 +1,18 @@
-'use strict';
+import assert from 'node:assert';
+import BoxError from './boxerror.js';
+import * as database from './database.js';
+import debugModule from 'debug';
+import promiseRetry from './promise-retry.js';
 
-exports = module.exports = {
+const debug = debugModule('box:locks');
+
+const TYPE_APP_TASK_PREFIX = 'app_task_';
+const TYPE_APP_BACKUP_PREFIX = 'app_backup_';
+const TYPE_BOX_UPDATE = 'box_update';
+const TYPE_BOX_UPDATE_TASK = 'box_update_task';
+const TYPE_FULL_BACKUP_TASK_PREFIX = 'full_backup_task_';
+
+export default {
     setTaskId,
 
     acquire,
@@ -10,21 +22,15 @@ exports = module.exports = {
     releaseAll,
     releaseByTaskId,
 
-    TYPE_APP_TASK_PREFIX: 'app_task_',
-    TYPE_APP_BACKUP_PREFIX: 'app_backup_',
-    TYPE_BOX_UPDATE: 'box_update', // for the actual update and after the backup. this allows the backup before update do not block
-    TYPE_BOX_UPDATE_TASK: 'box_update_task', // for scheduling the update task
-    TYPE_FULL_BACKUP_TASK_PREFIX: 'full_backup_task_', // for scheduling the backup task
+    TYPE_APP_TASK_PREFIX,
+    TYPE_APP_BACKUP_PREFIX,
+    TYPE_BOX_UPDATE,
+    TYPE_BOX_UPDATE_TASK,
+    TYPE_FULL_BACKUP_TASK_PREFIX,
 
     TYPE_MAIL_SERVER_RESTART: 'mail_restart',
 };
 
-const assert = require('node:assert'),
-    BoxError = require('./boxerror.js'),
-    database = require('./database.js'),
-    debug = require('debug')('box:locks'),
-    promiseRetry = require('./promise-retry.js');
-
 let gTaskId = null;
 
 function setTaskId(taskId) {
@@ -52,15 +58,15 @@ function canAcquire(data, type) {
 
     if (type in data) return new BoxError(BoxError.BAD_STATE, `Locked by ${data[type]}`);
 
-    if (type === exports.TYPE_BOX_UPDATE) {
-        if (Object.keys(data).some(k => k.startsWith(exports.TYPE_APP_TASK_PREFIX))) return new BoxError(BoxError.BAD_STATE, 'One or more app tasks are active');
-        if (Object.keys(data).some(k => k.startsWith(exports.TYPE_APP_BACKUP_PREFIX))) return new BoxError(BoxError.BAD_STATE, 'One or more app backups are active');
-    } else if (type.startsWith(exports.TYPE_APP_TASK_PREFIX)) {
-        if (exports.TYPE_BOX_UPDATE in data) return new BoxError(BoxError.BAD_STATE, 'Update is active');
-    } else if (type.startsWith(exports.TYPE_FULL_BACKUP_TASK_PREFIX)) {
-        if (exports.TYPE_BOX_UPDATE_TASK in data) return new BoxError(BoxError.BAD_STATE, 'Update task is active');
-    } else if (type === exports.TYPE_BOX_UPDATE_TASK) {
-        if (Object.keys(data).some(k => k.startsWith(exports.TYPE_FULL_BACKUP_TASK_PREFIX))) return new BoxError(BoxError.BAD_STATE, 'One or more backup tasks is active');
+    if (type === TYPE_BOX_UPDATE) {
+        if (Object.keys(data).some(k => k.startsWith(TYPE_APP_TASK_PREFIX))) return new BoxError(BoxError.BAD_STATE, 'One or more app tasks are active');
+        if (Object.keys(data).some(k => k.startsWith(TYPE_APP_BACKUP_PREFIX))) return new BoxError(BoxError.BAD_STATE, 'One or more app backups are active');
+    } else if (type.startsWith(TYPE_APP_TASK_PREFIX)) {
+        if (TYPE_BOX_UPDATE in data) return new BoxError(BoxError.BAD_STATE, 'Update is active');
+    } else if (type.startsWith(TYPE_FULL_BACKUP_TASK_PREFIX)) {
+        if (TYPE_BOX_UPDATE_TASK in data) return new BoxError(BoxError.BAD_STATE, 'Update task is active');
+    } else if (type === TYPE_BOX_UPDATE_TASK) {
+        if (Object.keys(data).some(k => k.startsWith(TYPE_FULL_BACKUP_TASK_PREFIX))) return new BoxError(BoxError.BAD_STATE, 'One or more backup tasks is active');
     }
 
     // TYPE_APP_BACKUP_PREFIX , TYPE_MAIL_SERVER_RESTART can co-run with everything except themselves