Migrate codebase from CommonJS to ES Modules

- Convert all require()/module.exports to import/export across 260+ files
- Add "type": "module" to package.json to enable ESM by default
- Add migrations/package.json with "type": "commonjs" to keep db-migrate compatible
- Convert eslint.config.js to ESM with sourceType: "module"
- Replace __dirname/__filename with import.meta.dirname/import.meta.filename
- Replace require.main === module with process.argv[1] === import.meta.filename
- Remove 'use strict' directives (implicit in ESM)
- Convert dynamic require() in switch statements to static import lookup maps
  (dns.js, domains.js, backupformats.js, backupsites.js, network.js)
- Extract self-referencing exports.CONSTANT patterns into standalone const
  declarations (apps.js, services.js, locks.js, users.js, mail.js, etc.)
- Lazify SERVICES object in services.js to avoid circular dependency TDZ issues
- Add clearMailQueue() to mailer.js for ESM-safe queue clearing in tests
- Add _setMockApp() to ldapserver.js for ESM-safe test mocking
- Add _setMockResolve() wrapper to dig.js for ESM-safe DNS mocking in tests
- Convert backupupload.js to use dynamic imports so --check exits before
  loading the module graph (which requires BOX_ENV)
- Update check-install to use ESM import for infra_version.js
- Convert scripts/ (hotfix, release, remote_hotfix.js, find-unused-translations)
- All 1315 tests passing

Migration stats (AI-assisted using Cursor with Claude):
- Wall clock time: ~3-4 hours
- Assistant completions: ~80-100
- Estimated token usage: ~1-2M tokens

Co-authored-by: Cursor <cursoragent@cursor.com>

src/oidcserver.js

@@ -1,6 +1,39 @@
-'use strict';
+import assert from 'node:assert';
+import apps from './apps.js';
+import AuditSource from './auditsource.js';
+import BoxError from './boxerror.js';
+import blobs from './blobs.js';
+import * as branding from './branding.js';
+import constants from './constants.js';
+import crypto from 'node:crypto';
+import * as dashboard from './dashboard.js';
+import debugModule from 'debug';
+import * as dns from './dns.js';
+import ejs from 'ejs';
+import express from 'express';
+import eventlog from './eventlog.js';
+import fs from 'node:fs';
+import * as marked from 'marked';
+import * as middleware from './middleware/index.js';
+import oidcClients from './oidcclients.js';
+import * as passkeys from './passkeys.js';
+import path from 'node:path';
+import paths from './paths.js';
+import http from 'node:http';
+import { HttpError } from '@cloudron/connect-lastmile';
+import * as jose from 'jose';
+import safe from 'safetydance';
+import * as settings from './settings.js';
+import superagent from '@cloudron/superagent';
+import * as tokens from './tokens.js';
+import url from 'node:url';
+import * as users from './users.js';
+import * as groups from './groups.js';
+import util from 'node:util';
 
-exports = module.exports = {
+const debug = debugModule('box:oidcserver');
+
+export {
     start,
     stop,
     revokeByUsername,
@@ -9,39 +42,6 @@ exports = module.exports = {
     cleanupExpired,
 };
 
-const assert = require('node:assert'),
-    apps = require('./apps.js'),
-    AuditSource = require('./auditsource.js'),
-    BoxError = require('./boxerror.js'),
-    blobs = require('./blobs.js'),
-    branding = require('./branding.js'),
-    constants = require('./constants.js'),
-    crypto = require('node:crypto'),
-    dashboard = require('./dashboard.js'),
-    debug = require('debug')('box:oidcserver'),
-    dns = require('./dns.js'),
-    ejs = require('ejs'),
-    express = require('express'),
-    eventlog = require('./eventlog.js'),
-    fs = require('node:fs'),
-    marked = require('marked'),
-    middleware = require('./middleware'),
-    oidcClients = require('./oidcclients.js'),
-    passkeys = require('./passkeys.js'),
-    path = require('node:path'),
-    paths = require('./paths.js'),
-    http = require('node:http'),
-    HttpError = require('@cloudron/connect-lastmile').HttpError,
-    jose = require('jose'),
-    safe = require('safetydance'),
-    settings = require('./settings.js'),
-    superagent = require('@cloudron/superagent'),
-    tokens = require('./tokens.js'),
-    url = require('node:url'),
-    users = require('./users.js'),
-    groups = require('./groups.js'),
-    util = require('node:util');
-
 // 1. Index.vue starts the OIDC flow by navigating to /openid/auth. Webadmin sets callback url to authcallback.html + implicit flow
 // 2. oidcserver starts an interaction and redirects to oidc_login.html
 // 3. oidc_login.html is rendered by renderInteractionPage() with the form submit url /interaction/:uid/login