fix(routes): restore ctx access in 15 route files broken by Phase 2.1 refactor

The modular refactor changed function signatures to destructured deps but
left internal ctx.* references intact, causing "ctx is not defined" errors
on /api/config, /api/logo, and many other endpoints. Also implements
loadTotpConfig and saveTotpConfig which were left as stubs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dashcaddy-api/src/app.js

@@ -102,13 +102,25 @@ async function createApp() {
     log.warn('server', 'CA cert not found — HTTPS calls may fail', { path: CA_CERT_PATH });
   }
 
-  // TOTP configuration
+  // TOTP configuration (defaults, overridden by loadTotpConfig below)
   let totpConfig = {
     enabled: false,
     sessionDuration: 'never',
     isSetUp: false
   };
 
+  // Load TOTP config from file
+  try {
+    if (fs.existsSync(config.TOTP_CONFIG_FILE)) {
+      const loaded = JSON.parse(fs.readFileSync(config.TOTP_CONFIG_FILE, 'utf8'));
+      delete loaded.secret; // secret belongs only in credential-manager
+      Object.assign(totpConfig, loaded);
+      log.info('config', 'TOTP config loaded', { enabled: totpConfig.enabled });
+    }
+  } catch (e) {
+    log.warn('config', 'Could not load TOTP config', { error: e.message });
+  }
+
   // Tailscale configuration  
   let tailscaleConfig = {
     enabled: false,
@@ -192,7 +204,12 @@ async function createApp() {
   }
 
   async function saveTotpConfig() {
-    // Stub - will be implemented
+    try {
+      const { writeJsonFile } = require('../fs-helpers');
+      await writeJsonFile(config.TOTP_CONFIG_FILE, totpConfig);
+    } catch (e) {
+      log.error('config', 'Could not save TOTP config', { error: e.message });
+    }
   }
 
   async function loadNotificationConfig() {