Migrate 25 route files to throw-based error handling

Converted routes:
- All auth routes (totp.js, keys.js, sso-gate.js)
- Recipe deployment routes (deploy.js, manage.js, index.js)
- App deployment routes
- Config routes (assets, backup, settings)
- ARR routes (config, credentials)
- Infrastructure routes (dns, services, sites, logs)
- Additional routes (browse, ca, health, license, notifications, tailscale, updates)

Changes:
- Replaced ctx.errorResponse() with throw statements
- Replaced errorResponse() with throw statements
- Added proper error imports to each file
- 400 errors → ValidationError
- 401 errors → AuthenticationError
- 403 errors → ForbiddenError
- 404 errors → NotFoundError
- 409 errors → ConflictError
- 500 errors → Handled by middleware

Result: 25 files migrated, ~150 error responses standardized

dashcaddy-api/routes/arr/config.js

@@ -1,6 +1,7 @@
 const express = require('express');
 const { APP_PORTS, ARR_SERVICES } = require('../../constants');
 const { validateURL, validateToken } = require('../../input-validator');
+const { ValidationError, AuthenticationError, NotFoundError } = require('../errors');
 
 module.exports = function(ctx, helpers) {
   const router = express.Router();
@@ -192,7 +193,7 @@ module.exports = function(ctx, helpers) {
       const { service, url, apiKey } = req.body;
 
       if (!url || !apiKey) {
-        return ctx.errorResponse(res, 400, 'URL and API key required');
+        throw new ValidationError('URL and API key required');
       }
 
       // Validate URL format
@@ -206,7 +207,7 @@ module.exports = function(ctx, helpers) {
       try {
         validateToken(apiKey);
       } catch (validationErr) {
-        return ctx.errorResponse(res, 400, 'Invalid API key format');
+        throw new ValidationError('Invalid API key format');
       }
 
       // Normalize URL - remove trailing slash
@@ -247,9 +248,9 @@ module.exports = function(ctx, helpers) {
           appName
         });
       } else if (response.status === 401) {
-        return ctx.errorResponse(res, 401, 'Invalid API key');
+        throw new AuthenticationError('Invalid API key');
       } else if (response.status === 404) {
-        return ctx.errorResponse(res, 404, 'API not found - check URL');
+        throw new NotFoundError('API not found - check URL');
       } else {
         return ctx.errorResponse(res, 502, `HTTP ${response.status}`);
       }
@@ -484,7 +485,7 @@ module.exports = function(ctx, helpers) {
     const { service, url, apiKey } = req.query;
 
     if (!service || !['radarr', 'sonarr'].includes(service)) {
-      return ctx.errorResponse(res, 400, 'Service must be radarr or sonarr');
+      throw new ValidationError('Service must be radarr or sonarr');
     }
 
     // Resolve API key: from query param, or from stored credentials
@@ -513,7 +514,7 @@ module.exports = function(ctx, helpers) {
     }
 
     if (!resolvedKey || !resolvedUrl) {
-      return ctx.errorResponse(res, 400, 'Could not resolve API key or URL for this service');
+      throw new ValidationError('Could not resolve API key or URL for this service');
     }
 
     const baseUrl = resolvedUrl.replace(/\/+$/, '');
@@ -553,17 +554,17 @@ module.exports = function(ctx, helpers) {
     const { service, qualityProfileId, qualityProfileName } = req.body;
 
     if (!service || !['radarr', 'sonarr'].includes(service)) {
-      return ctx.errorResponse(res, 400, 'Service must be radarr or sonarr');
+      throw new ValidationError('Service must be radarr or sonarr');
     }
     if (!qualityProfileId) {
-      return ctx.errorResponse(res, 400, 'qualityProfileId required');
+      throw new ValidationError('qualityProfileId required');
     }
 
     const credKey = `arr.${service}.apikey`;
     const existing = await ctx.credentialManager.getMetadata(credKey);
 
     if (!existing) {
-      return ctx.errorResponse(res, 404, 'No stored credentials for this service');
+      throw new NotFoundError('No stored credentials for this service');
     }
 
     // Merge quality profile into existing metadata