Migrate 25 route files to throw-based error handling

Converted routes:
- All auth routes (totp.js, keys.js, sso-gate.js)
- Recipe deployment routes (deploy.js, manage.js, index.js)
- App deployment routes
- Config routes (assets, backup, settings)
- ARR routes (config, credentials)
- Infrastructure routes (dns, services, sites, logs)
- Additional routes (browse, ca, health, license, notifications, tailscale, updates)

Changes:
- Replaced ctx.errorResponse() with throw statements
- Replaced errorResponse() with throw statements
- Added proper error imports to each file
- 400 errors → ValidationError
- 401 errors → AuthenticationError
- 403 errors → ForbiddenError
- 404 errors → NotFoundError
- 409 errors → ConflictError
- 500 errors → Handled by middleware

Result: 25 files migrated, ~150 error responses standardized

dashcaddy-api/routes/apps/deploy.js

@@ -6,6 +6,7 @@ const { REGEX, DOCKER } = require('../../constants');
 const { isValidPort } = require('../../input-validator');
 const { exists } = require('../../fs-helpers');
 const platformPaths = require('../../platform-paths');
+const { ValidationError } = require('../errors');
 
 module.exports = function(ctx, helpers) {
   const router = express.Router();
@@ -190,7 +191,7 @@ module.exports = function(ctx, helpers) {
   router.post('/apps/check-existing', ctx.asyncHandler(async (req, res) => {
     const { appId } = req.body;
     const template = ctx.APP_TEMPLATES[appId];
-    if (!template) return ctx.errorResponse(res, 400, 'Invalid app template');
+    if (!template) throw new ValidationError('Invalid app template');
     const existingContainer = await helpers.findExistingContainerByImage(template);
     if (existingContainer) {
       res.json({ success: true, exists: true, container: existingContainer, message: `Found existing ${template.name} container: ${existingContainer.name}` });
@@ -203,25 +204,25 @@ module.exports = function(ctx, helpers) {
   router.post('/apps/deploy', ctx.asyncHandler(async (req, res) => {
     const { appId, config } = req.body;
     if (!appId || typeof appId !== 'string') {
-      return ctx.errorResponse(res, 400, 'appId is required');
+      throw new ValidationError('appId is required');
     }
     if (!config || typeof config !== 'object') {
-      return ctx.errorResponse(res, 400, 'config object is required');
+      throw new ValidationError('config object is required');
     }
     if (!config.subdomain || typeof config.subdomain !== 'string') {
-      return ctx.errorResponse(res, 400, 'config.subdomain is required');
+      throw new ValidationError('config.subdomain is required');
     }
     try {
       ctx.log.info('deploy', 'Deploying app', { appId, subdomain: config.subdomain });
       const template = ctx.APP_TEMPLATES[appId];
       if (!template) {
         await ctx.logError('app-deploy', new Error('Invalid app template'), { appId, config });
-        return ctx.errorResponse(res, 400, 'Invalid app template');
+        throw new ValidationError('Invalid app template');
       }
 
       if (config.subdomain) {
         if (!REGEX.SUBDOMAIN.test(config.subdomain)) {
-          return ctx.errorResponse(res, 400, '[DC-301] Invalid subdomain format');
+          throw new ValidationError('[DC-301] Invalid subdomain format');
         }
         // Block reserved path names in subdirectory mode
         if (ctx.siteConfig.routingMode === 'subdirectory' && helpers.RESERVED_SUBPATHS.includes(config.subdomain)) {
@@ -229,7 +230,7 @@ module.exports = function(ctx, helpers) {
         }
       }
       if (config.port && !isValidPort(config.port)) {
-        return ctx.errorResponse(res, 400, 'Invalid port number (must be 1-65535)');
+        throw new ValidationError('Invalid port number (must be 1-65535)');
       }
 
       if (!template.isStaticSite) {

dashcaddy-api/routes/apps/templates.js

@@ -56,13 +56,13 @@ module.exports = function(ctx, helpers) {
   router.post('/apps/update-subdomain', ctx.asyncHandler(async (req, res) => {
     const { serviceId, oldSubdomain, newSubdomain, containerId, ip } = req.body;
     if (!oldSubdomain || typeof oldSubdomain !== 'string') {
-      return ctx.errorResponse(res, 400, 'oldSubdomain is required');
+      throw new ValidationError('oldSubdomain is required');
     }
     if (!newSubdomain || typeof newSubdomain !== 'string') {
-      return ctx.errorResponse(res, 400, 'newSubdomain is required');
+      throw new ValidationError('newSubdomain is required');
     }
     if (!REGEX.SUBDOMAIN.test(newSubdomain)) {
-      return ctx.errorResponse(res, 400, '[DC-301] Invalid subdomain format for newSubdomain');
+      throw new ValidationError('[DC-301] Invalid subdomain format for newSubdomain');
     }
     ctx.log.info('deploy', 'Updating subdomain', { oldSubdomain, newSubdomain });
     const results = { oldDns: null, newDns: null, caddy: null, service: null };