Migrate codebase from CommonJS to ES Modules

- Convert all require()/module.exports to import/export across 260+ files
- Add "type": "module" to package.json to enable ESM by default
- Add migrations/package.json with "type": "commonjs" to keep db-migrate compatible
- Convert eslint.config.js to ESM with sourceType: "module"
- Replace __dirname/__filename with import.meta.dirname/import.meta.filename
- Replace require.main === module with process.argv[1] === import.meta.filename
- Remove 'use strict' directives (implicit in ESM)
- Convert dynamic require() in switch statements to static import lookup maps
  (dns.js, domains.js, backupformats.js, backupsites.js, network.js)
- Extract self-referencing exports.CONSTANT patterns into standalone const
  declarations (apps.js, services.js, locks.js, users.js, mail.js, etc.)
- Lazify SERVICES object in services.js to avoid circular dependency TDZ issues
- Add clearMailQueue() to mailer.js for ESM-safe queue clearing in tests
- Add _setMockApp() to ldapserver.js for ESM-safe test mocking
- Add _setMockResolve() wrapper to dig.js for ESM-safe DNS mocking in tests
- Convert backupupload.js to use dynamic imports so --check exits before
  loading the module graph (which requires BOX_ENV)
- Update check-install to use ESM import for infra_version.js
- Convert scripts/ (hotfix, release, remote_hotfix.js, find-unused-translations)
- All 1315 tests passing

Migration stats (AI-assisted using Cursor with Claude):
- Wall clock time: ~3-4 hours
- Assistant completions: ~80-100
- Estimated token usage: ~1-2M tokens

Co-authored-by: Cursor <cursoragent@cursor.com>

src/tasks.js

@@ -1,6 +1,23 @@
-'use strict';
+import assert from 'node:assert';
+import BoxError from './boxerror.js';
+import * as database from './database.js';
+import debugModule from 'debug';
+import * as logs from './logs.js';
+import mysql from 'mysql2';
+import path from 'node:path';
+import paths from './paths.js';
+import safe from 'safetydance';
+import shellModule from './shell.js';
+import * as _ from './underscore.js';
 
-exports = module.exports = {
+const debug = debugModule('box:tasks');
+const shell = shellModule('tasks');
+
+const ESTOPPED = 'stopped';
+const ECRASHED = 'crashed';
+const ETIMEOUT = 'timeout';
+
+export default {
     get,
     add,
     update,
@@ -38,10 +55,9 @@ exports = module.exports = {
     TASK_CHECK_BACKUP_INTEGRITY: 'checkBackupIntegrity',
 
     // error codes
-    ESTOPPED: 'stopped',
-    ECRASHED: 'crashed',
-    ETIMEOUT: 'timeout',
-
+    ESTOPPED,
+    ECRASHED,
+    ETIMEOUT,
     // testing
     _TASK_IDENTITY: 'identity',
     _TASK_CRASH: 'crash',
@@ -49,22 +65,10 @@ exports = module.exports = {
     _TASK_SLEEP: 'sleep'
 };
 
-const assert = require('node:assert'),
-    BoxError = require('./boxerror.js'),
-    database = require('./database.js'),
-    debug = require('debug')('box:tasks'),
-    logs = require('./logs.js'),
-    mysql = require('mysql2'),
-    path = require('node:path'),
-    paths = require('./paths.js'),
-    safe = require('safetydance'),
-    shell = require('./shell.js')('tasks'),
-    _ = require('./underscore.js');
-
 let gTasks = {}; // holds AbortControllers indexed by task id
 
-const START_TASK_CMD = path.join(__dirname, 'scripts/starttask.sh');
-const STOP_TASK_CMD = path.join(__dirname, 'scripts/stoptask.sh');
+const START_TASK_CMD = path.join(import.meta.dirname, 'scripts/starttask.sh');
+const STOP_TASK_CMD = path.join(import.meta.dirname, 'scripts/stoptask.sh');
 
 const TASKS_FIELDS = [ 'id', 'type', 'argsJson', 'percent', 'pending', 'completed', 'message', 'errorJson', 'creationTime', 'resultJson', 'ts' ];
 
@@ -94,7 +98,7 @@ function postProcess(task) {
 
     // the error in db will be empty if task is done but the completed flag is not set
     if (!task.active && !task.completed) {
-        task.error = { message: 'Task was stopped because the server restarted or crashed', code: exports.ECRASHED };
+        task.error = { message: 'Task was stopped because the server restarted or crashed', code: ECRASHED };
     }
 
     return task;
@@ -238,11 +242,11 @@ async function startTask(id, options) {
 
     // taskworker.sh forwards the exit code of the actual worker. It's either a raw signal number OR the exit code
     let taskError = null;
-    if (sudoError.timedOut) taskError = { message: `Task ${id} timed out`, code: exports.ETIMEOUT };
-    else if (sudoError.code === 70) taskError = { message: `Task ${id} stopped`, code: exports.ESTOPPED }; // set by taskworker SIGTERM
-    else if (sudoError.code === 9 /* SIGKILL */) taskError = { message: `Task ${id} ran out of memory or terminated`, code: exports.ECRASHED }; // SIGTERM with oom gets set as 2 by nodejs
-    else if (sudoError.code === 50) taskError = { message:`Task ${id} crashed with code ${sudoError.code}`, code: exports.ECRASHED };
-    else taskError = { message:`Task ${id} crashed with unknown code ${sudoError.code}`, code: exports.ECRASHED };
+    if (sudoError.timedOut) taskError = { message: `Task ${id} timed out`, code: ETIMEOUT };
+    else if (sudoError.code === 70) taskError = { message: `Task ${id} stopped`, code: ESTOPPED }; // set by taskworker SIGTERM
+    else if (sudoError.code === 9 /* SIGKILL */) taskError = { message: `Task ${id} ran out of memory or terminated`, code: ECRASHED }; // SIGTERM with oom gets set as 2 by nodejs
+    else if (sudoError.code === 50) taskError = { message:`Task ${id} crashed with code ${sudoError.code}`, code: ECRASHED };
+    else taskError = { message:`Task ${id} crashed with unknown code ${sudoError.code}`, code: ECRASHED };
 
     debug(`startTask: ${id} done. error: %o`, taskError);
     await safe(setCompleted(id, { error: taskError }), { debug });