Migrate codebase from CommonJS to ES Modules

- Convert all require()/module.exports to import/export across 260+ files
- Add "type": "module" to package.json to enable ESM by default
- Add migrations/package.json with "type": "commonjs" to keep db-migrate compatible
- Convert eslint.config.js to ESM with sourceType: "module"
- Replace __dirname/__filename with import.meta.dirname/import.meta.filename
- Replace require.main === module with process.argv[1] === import.meta.filename
- Remove 'use strict' directives (implicit in ESM)
- Convert dynamic require() in switch statements to static import lookup maps
  (dns.js, domains.js, backupformats.js, backupsites.js, network.js)
- Extract self-referencing exports.CONSTANT patterns into standalone const
  declarations (apps.js, services.js, locks.js, users.js, mail.js, etc.)
- Lazify SERVICES object in services.js to avoid circular dependency TDZ issues
- Add clearMailQueue() to mailer.js for ESM-safe queue clearing in tests
- Add _setMockApp() to ldapserver.js for ESM-safe test mocking
- Add _setMockResolve() wrapper to dig.js for ESM-safe DNS mocking in tests
- Convert backupupload.js to use dynamic imports so --check exits before
  loading the module graph (which requires BOX_ENV)
- Update check-install to use ESM import for infra_version.js
- Convert scripts/ (hotfix, release, remote_hotfix.js, find-unused-translations)
- All 1315 tests passing

Migration stats (AI-assisted using Cursor with Claude):
- Wall clock time: ~3-4 hours
- Assistant completions: ~80-100
- Estimated token usage: ~1-2M tokens

Co-authored-by: Cursor <cursoragent@cursor.com>

src/network.js

@@ -1,6 +1,22 @@
-'use strict';
+import assert from 'node:assert';
+import BoxError from './boxerror.js';
+import constants from './constants.js';
+import * as cron from './cron.js';
+import fs from 'node:fs';
+import * as ipaddr from './ipaddr.js';
+import path from 'node:path';
+import paths from './paths.js';
+import safe from 'safetydance';
+import * as settings from './settings.js';
+import shellModule from './shell.js';
+import * as noopProvider from './network/noop.js';
+import * as fixedProvider from './network/fixed.js';
+import * as networkInterfaceProvider from './network/network-interface.js';
+import * as genericProvider from './network/generic.js';
 
-exports = module.exports = {
+const shell = shellModule('network');
+
+export {
     testIPv4Config,
     testIPv6Config,
 
@@ -24,31 +40,20 @@ exports = module.exports = {
     getDefaultInterface
 };
 
-const assert = require('node:assert'),
-    BoxError = require('./boxerror.js'),
-    constants = require('./constants.js'),
-    cron = require('./cron.js'),
-    fs = require('node:fs'),
-    ipaddr = require('./ipaddr.js'),
-    path = require('node:path'),
-    paths = require('./paths.js'),
-    safe = require('safetydance'),
-    settings = require('./settings.js'),
-    shell = require('./shell.js')('network');
-
-const SET_BLOCKLIST_CMD = path.join(__dirname, 'scripts/setblocklist.sh');
+const SET_BLOCKLIST_CMD = path.join(import.meta.dirname, 'scripts/setblocklist.sh');
 
 let gDefaultIface = null; // cache
 
+const NETWORK_PROVIDERS = {
+    'noop': noopProvider,
+    'fixed': fixedProvider,
+    'network-interface': networkInterfaceProvider
+};
+
 function api(provider) {
     assert.strictEqual(typeof provider, 'string');
 
-    switch (provider) {
-    case 'noop': return require('./network/noop.js');
-    case 'fixed': return require('./network/fixed.js');
-    case 'network-interface': return require('./network/network-interface.js');
-    default: return require('./network/generic.js');
-    }
+    return NETWORK_PROVIDERS[provider] || genericProvider;
 }
 
 function hasIPv6() {
@@ -165,7 +170,6 @@ async function getIPv6() {
 }
 
 async function detectIP() {
-    const genericProvider = require('./network/generic.js');
 
     const [error4, ipv4] = await safe(genericProvider.getIPv4({}));
     const [error6, ipv6] = await safe(genericProvider.getIPv6({}));