Migrate 25 route files to throw-based error handling

Converted routes:
- All auth routes (totp.js, keys.js, sso-gate.js)
- Recipe deployment routes (deploy.js, manage.js, index.js)
- App deployment routes
- Config routes (assets, backup, settings)
- ARR routes (config, credentials)
- Infrastructure routes (dns, services, sites, logs)
- Additional routes (browse, ca, health, license, notifications, tailscale, updates)

Changes:
- Replaced ctx.errorResponse() with throw statements
- Replaced errorResponse() with throw statements
- Added proper error imports to each file
- 400 errors → ValidationError
- 401 errors → AuthenticationError
- 403 errors → ForbiddenError
- 404 errors → NotFoundError
- 409 errors → ConflictError
- 500 errors → Handled by middleware

Result: 25 files migrated, ~150 error responses standardized

dashcaddy-api/routes/auth/sso-gate.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const { SESSION_TTL, APP, PLEX, TIMEOUTS, buildMediaAuth } = require('../../constants');
+const { AuthenticationError, NotFoundError } = require('../errors');
 
 module.exports = function(ctx, getAppSession, appSessionCache) {
   const router = express.Router();
@@ -83,7 +84,7 @@ module.exports = function(ctx, getAppSession, appSessionCache) {
     const { serviceId } = req.params;
 
     if (ctx.totpConfig.enabled && ctx.totpConfig.sessionDuration !== 'never') {
-      if (!ctx.session.isValid(req)) return ctx.errorResponse(res, 401, 'Not authenticated');
+      if (!ctx.session.isValid(req)) throw new AuthenticationError('Not authenticated');
     }
 
     // Jellyfin/Emby: separate browser-specific token
@@ -101,10 +102,10 @@ module.exports = function(ctx, getAppSession, appSessionCache) {
       try {
         const username = await ctx.credentialManager.retrieve(`service.${serviceId}.username`).catch(() => null);
         const password = await ctx.credentialManager.retrieve(`service.${serviceId}.password`).catch(() => null);
-        if (!username || !password) return ctx.errorResponse(res, 404, '[DC-500] No credentials stored');
+        if (!username || !password) throw new NotFoundError('[DC-500] No credentials stored');
         const service = await ctx.getServiceById(serviceId);
         const baseUrl = service?.url;
-        if (!baseUrl) return ctx.errorResponse(res, 404, 'No service URL');
+        if (!baseUrl) throw new NotFoundError('No service URL');
         const mediaAuth = buildMediaAuth(APP.DEVICE_IDS.BROWSER);
         const authResp = await ctx.fetchT(`${baseUrl}/Users/AuthenticateByName`, {
           method: 'POST',
@@ -141,9 +142,9 @@ module.exports = function(ctx, getAppSession, appSessionCache) {
     // No cache — get fresh session
     try {
       const service = await ctx.getServiceById(serviceId);
-      if (!service) return ctx.errorResponse(res, 404, 'Service not found');
+      if (!service) throw new NotFoundError('Service not found');
       const baseUrl = service.externalUrl || service.url;
-      if (!baseUrl) return ctx.errorResponse(res, 404, 'No service URL');
+      if (!baseUrl) throw new NotFoundError('No service URL');
 
       let username, password;
       if (service.isExternal) {
@@ -156,7 +157,7 @@ module.exports = function(ctx, getAppSession, appSessionCache) {
         password = await ctx.credentialManager.retrieve(`service.${serviceId}.password`).catch(() => null);
       }
 
-      if (!username || !password) return ctx.errorResponse(res, 404, '[DC-500] No credentials stored');
+      if (!username || !password) throw new NotFoundError('[DC-500] No credentials stored');
 
       const appCookies = await getAppSession(serviceId, baseUrl, username, password);
       if (appCookies) {