Migrate 25 route files to throw-based error handling

Converted routes:
- All auth routes (totp.js, keys.js, sso-gate.js)
- Recipe deployment routes (deploy.js, manage.js, index.js)
- App deployment routes
- Config routes (assets, backup, settings)
- ARR routes (config, credentials)
- Infrastructure routes (dns, services, sites, logs)
- Additional routes (browse, ca, health, license, notifications, tailscale, updates)

Changes:
- Replaced ctx.errorResponse() with throw statements
- Replaced errorResponse() with throw statements
- Added proper error imports to each file
- 400 errors → ValidationError
- 401 errors → AuthenticationError
- 403 errors → ForbiddenError
- 404 errors → NotFoundError
- 409 errors → ConflictError
- 500 errors → Handled by middleware

Result: 25 files migrated, ~150 error responses standardized

dashcaddy-api/routes/tailscale.js

@@ -126,7 +126,7 @@ module.exports = function(ctx) {
     const { subdomain, tailscaleOnly, allowedIPs } = req.body;
 
     if (!subdomain) {
-      return ctx.errorResponse(res, 400, 'subdomain is required');
+      throw new ValidationError('subdomain is required');
     }
 
     let content = await ctx.caddy.read();
@@ -142,7 +142,7 @@ module.exports = function(ctx) {
 
     const proxyMatch = match[0].match(/reverse_proxy\s+([^\s\n]+)/);
     if (!proxyMatch) {
-      return ctx.errorResponse(res, 400, 'Could not parse service configuration');
+      throw new ValidationError('Could not parse service configuration');
     }
 
     const [ip, port] = proxyMatch[1].split(':');
@@ -181,7 +181,7 @@ module.exports = function(ctx) {
     const { clientId, clientSecret, tailnet } = req.body;
 
     if (!clientId || !clientSecret || !tailnet) {
-      return ctx.errorResponse(res, 400, 'clientId, clientSecret, and tailnet are required');
+      throw new ValidationError('clientId, clientSecret, and tailnet are required');
     }
 
     // Validate by exchanging for a real token
@@ -252,7 +252,7 @@ module.exports = function(ctx) {
   // Get enriched device list from Tailscale API
   router.get('/api-devices', ctx.asyncHandler(async (req, res) => {
     if (!ctx.tailscale.config.oauthConfigured) {
-      return ctx.errorResponse(res, 400, 'Tailscale API not configured. Set up OAuth first.');
+      throw new ValidationError('Tailscale API not configured. Set up OAuth first.');
     }
 
     // Return cached devices from last sync
@@ -266,7 +266,7 @@ module.exports = function(ctx) {
   // Manually trigger an API sync
   router.post('/sync', ctx.asyncHandler(async (req, res) => {
     if (!ctx.tailscale.config.oauthConfigured) {
-      return ctx.errorResponse(res, 400, 'Tailscale API not configured. Set up OAuth first.');
+      throw new ValidationError('Tailscale API not configured. Set up OAuth first.');
     }
 
     const devices = await ctx.tailscale.syncAPI();
@@ -283,7 +283,7 @@ module.exports = function(ctx) {
     const token = await ctx.tailscale.getAccessToken();
     const tailnet = ctx.tailscale.config.tailnet;
     if (!token || !tailnet) {
-      return ctx.errorResponse(res, 400, 'Tailscale API not configured');
+      throw new ValidationError('Tailscale API not configured');
     }
 
     const aclRes = await fetch(`${TAILSCALE.API_BASE}/tailnet/${encodeURIComponent(tailnet)}/acl`, {