Migrate 25 route files to throw-based error handling

Converted routes:
- All auth routes (totp.js, keys.js, sso-gate.js)
- Recipe deployment routes (deploy.js, manage.js, index.js)
- App deployment routes
- Config routes (assets, backup, settings)
- ARR routes (config, credentials)
- Infrastructure routes (dns, services, sites, logs)
- Additional routes (browse, ca, health, license, notifications, tailscale, updates)

Changes:
- Replaced ctx.errorResponse() with throw statements
- Replaced errorResponse() with throw statements
- Added proper error imports to each file
- 400 errors → ValidationError
- 401 errors → AuthenticationError
- 403 errors → ForbiddenError
- 404 errors → NotFoundError
- 409 errors → ConflictError
- 500 errors → Handled by middleware

Result: 25 files migrated, ~150 error responses standardized

dashcaddy-api/routes/arr/credentials.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const { validateURL, validateToken } = require('../../input-validator');
+const { ValidationError } = require('../errors');
 
 module.exports = function(ctx, helpers) {
   const router = express.Router();
@@ -9,7 +10,7 @@ module.exports = function(ctx, helpers) {
     const { service, apiKey, url, seedboxBaseUrl, qualityProfileId, qualityProfileName } = req.body;
 
     if (!service || !apiKey) {
-      return ctx.errorResponse(res, 400, 'Service name and API key required');
+      throw new ValidationError('Service name and API key required');
     }
 
     const validServices = ['radarr', 'sonarr', 'prowlarr', 'lidarr', 'plex'];
@@ -21,13 +22,13 @@ module.exports = function(ctx, helpers) {
     try {
       validateToken(apiKey);
     } catch (e) {
-      return ctx.errorResponse(res, 400, 'Invalid API key format');
+      throw new ValidationError('Invalid API key format');
     }
 
     // Validate URL if provided
     if (url) {
       try { validateURL(url); } catch (e) {
-        return ctx.errorResponse(res, 400, 'Invalid URL format');
+        throw new ValidationError('Invalid URL format');
       }
     }
 
@@ -80,7 +81,7 @@ module.exports = function(ctx, helpers) {
     // Optionally store seedbox base URL
     if (seedboxBaseUrl) {
       try { validateURL(seedboxBaseUrl); } catch (e) {
-        return ctx.errorResponse(res, 400, 'Invalid seedbox base URL');
+        throw new ValidationError('Invalid seedbox base URL');
       }
       await ctx.credentialManager.store('arr.seedbox.baseurl', seedboxBaseUrl, {
         storedAt: new Date().toISOString()