Fix input validation and error handling across API endpoints

- Deploy endpoint: validate appId, config, and subdomain before use (prevents 500 crash on empty body)
- Container ops: return 404 instead of 500 for non-existent containers
- Update-subdomain: require oldSubdomain/newSubdomain fields (prevents false 200 with undefined values)
- Global error handler: catch-all that never leaks stack traces or internal paths
- API 404 catch-all: return JSON instead of HTML for unmatched /api/* routes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dashcaddy-api/routes/apps/deploy.js

@@ -184,6 +184,15 @@ module.exports = function(ctx, helpers) {
   // Deploy new app
   router.post('/apps/deploy', ctx.asyncHandler(async (req, res) => {
     const { appId, config } = req.body;
+    if (!appId || typeof appId !== 'string') {
+      return ctx.errorResponse(res, 400, 'appId is required');
+    }
+    if (!config || typeof config !== 'object') {
+      return ctx.errorResponse(res, 400, 'config object is required');
+    }
+    if (!config.subdomain || typeof config.subdomain !== 'string') {
+      return ctx.errorResponse(res, 400, 'config.subdomain is required');
+    }
     try {
       ctx.log.info('deploy', 'Deploying app', { appId, subdomain: config.subdomain });
       const template = ctx.APP_TEMPLATES[appId];