Migrate 25 route files to throw-based error handling

Converted routes:
- All auth routes (totp.js, keys.js, sso-gate.js)
- Recipe deployment routes (deploy.js, manage.js, index.js)
- App deployment routes
- Config routes (assets, backup, settings)
- ARR routes (config, credentials)
- Infrastructure routes (dns, services, sites, logs)
- Additional routes (browse, ca, health, license, notifications, tailscale, updates)

Changes:
- Replaced ctx.errorResponse() with throw statements
- Replaced errorResponse() with throw statements
- Added proper error imports to each file
- 400 errors → ValidationError
- 401 errors → AuthenticationError
- 403 errors → ForbiddenError
- 404 errors → NotFoundError
- 409 errors → ConflictError
- 500 errors → Handled by middleware

Result: 25 files migrated, ~150 error responses standardized

dashcaddy-api/routes/notifications.js

@@ -1,6 +1,7 @@
 const express = require('express');
 const { validateURL, validateToken } = require('../input-validator');
 const { paginate, parsePaginationParams } = require('../pagination');
+const { ValidationError } = require('../errors');
 
 module.exports = function(ctx) {
   const router = express.Router();
@@ -43,27 +44,27 @@ module.exports = function(ctx) {
           try {
             validateURL(providers.discord.webhookUrl);
           } catch (validationErr) {
-            return ctx.errorResponse(res, 400, 'Invalid Discord webhook URL');
+            throw new ValidationError('Invalid Discord webhook URL');
           }
         }
         if (providers.telegram?.botToken) {
           try {
             validateToken(providers.telegram.botToken);
           } catch (validationErr) {
-            return ctx.errorResponse(res, 400, 'Invalid Telegram bot token format');
+            throw new ValidationError('Invalid Telegram bot token format');
           }
         }
         if (providers.ntfy?.serverUrl) {
           try {
             validateURL(providers.ntfy.serverUrl);
           } catch (validationErr) {
-            return ctx.errorResponse(res, 400, 'Invalid ntfy server URL');
+            throw new ValidationError('Invalid ntfy server URL');
           }
         }
         if (providers.ntfy?.topic) {
           const topicRegex = /^[a-zA-Z0-9_-]{1,64}$/;
           if (!topicRegex.test(providers.ntfy.topic)) {
-            return ctx.errorResponse(res, 400, 'Invalid ntfy topic (alphanumeric, hyphens, underscores only, max 64 chars)');
+            throw new ValidationError('Invalid ntfy topic (alphanumeric, hyphens, underscores only, max 64 chars)');
           }
         }
       }
@@ -137,7 +138,7 @@ module.exports = function(ctx) {
           result = await ctx.notification.sendNtfy('Test Notification', 'This is a test notification from DashCaddy.', 'info');
           break;
         default:
-          return ctx.errorResponse(res, 400, 'Unknown provider');
+          throw new ValidationError('Unknown provider');
       }
       res.json({ success: result.success, provider, error: result.error });
     } else {