refactor(server/api): writeErr accepts error; migrate admin handlers (1/3)

Rewrite writeErr(w, err) to wrap *apierror.Error via apierror.From,
preserving the existing {"error": {"code", "message"}} wire envelope.
Add writeErrWithLog helper for 500-class errors that need an operator
log line. Migrate all 13 admin_*.go handler files (~76 call sites) to
the new signature; T3 will sweep the remaining api package.

The old 4-arg writeErr is removed, so non-admin call sites in
internal/api will not compile until T3 lands. This is by design — T2
and T3 are paired.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/api/admin_coverart_research.go

@@ -1,6 +1,10 @@
 package api
 
-import "net/http"
+import (
+	"net/http"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
+)
 
 // handleResearchMissingArt bumps the cover-art version unconditionally
 // so every 'none' row becomes eligible at the next enrichment pass.
@@ -14,8 +18,7 @@ import "net/http"
 func (h *handlers) handleResearchMissingArt(w http.ResponseWriter, r *http.Request) {
 	newVer, err := h.coverSettings.BumpVersion(r.Context())
 	if err != nil {
-		h.logger.Error("admin: research missing art bump failed", "err", err)
-		writeErr(w, http.StatusInternalServerError, "server_error", "bump failed")
+		writeErrWithLog(w, h.logger, "admin: research missing art bump failed", apierror.Internal(err))
 		return
 	}
 	writeJSON(w, http.StatusOK, map[string]any{"version": newVer})