Migrate 25 route files to throw-based error handling

Converted routes:
- All auth routes (totp.js, keys.js, sso-gate.js)
- Recipe deployment routes (deploy.js, manage.js, index.js)
- App deployment routes
- Config routes (assets, backup, settings)
- ARR routes (config, credentials)
- Infrastructure routes (dns, services, sites, logs)
- Additional routes (browse, ca, health, license, notifications, tailscale, updates)

Changes:
- Replaced ctx.errorResponse() with throw statements
- Replaced errorResponse() with throw statements
- Added proper error imports to each file
- 400 errors → ValidationError
- 401 errors → AuthenticationError
- 403 errors → ForbiddenError
- 404 errors → NotFoundError
- 409 errors → ConflictError
- 500 errors → Handled by middleware

Result: 25 files migrated, ~150 error responses standardized

dashcaddy-api/routes/apps/templates.js

@@ -56,13 +56,13 @@ module.exports = function(ctx, helpers) {
   router.post('/apps/update-subdomain', ctx.asyncHandler(async (req, res) => {
     const { serviceId, oldSubdomain, newSubdomain, containerId, ip } = req.body;
     if (!oldSubdomain || typeof oldSubdomain !== 'string') {
-      return ctx.errorResponse(res, 400, 'oldSubdomain is required');
+      throw new ValidationError('oldSubdomain is required');
     }
     if (!newSubdomain || typeof newSubdomain !== 'string') {
-      return ctx.errorResponse(res, 400, 'newSubdomain is required');
+      throw new ValidationError('newSubdomain is required');
     }
     if (!REGEX.SUBDOMAIN.test(newSubdomain)) {
-      return ctx.errorResponse(res, 400, '[DC-301] Invalid subdomain format for newSubdomain');
+      throw new ValidationError('[DC-301] Invalid subdomain format for newSubdomain');
     }
     ctx.log.info('deploy', 'Updating subdomain', { oldSubdomain, newSubdomain });
     const results = { oldDns: null, newDns: null, caddy: null, service: null };