Port Express response JSON settings contracts

Context

The sequential Bun corpus frontier is js/third_party/express/res.json.test.ts at position 3965/4708, following text parser work in #222. This contributes to #66.

Acceptance criteria

• res.type() sets media types and res.json() preserves an existing type while adding UTF-8.
• JSON responses cover null, numbers, strings, arrays, objects, and undefined.
• Application get supports setting lookup without conflicting with GET route registration.
• json escape, json replacer, and json spaces feed response serialization exactly.
• The copied suite passes and is pinned in the permanent third-party gate.

Completed on main in 80769dd.

Express applications now distinguish one-argument setting lookup from GET route registration. Responses receive their application context, res.type() sets media types, and res.json() preserves an existing media type while adding UTF-8 and applying json escape, json replacer, and json spaces. Null, numeric, string, array, object, and undefined payloads all follow the copied contracts.

Verification: focused position 3965 reports files=1, passed=13, failed=0, todo=0, unsupported=0, allowed-empty=0; all permanent copied-corpus, SQL, and third-party gates pass.