refactor(server/api): writeErr accepts error; migrate admin handlers (1/3)

Rewrite writeErr(w, err) to wrap *apierror.Error via apierror.From,
preserving the existing {"error": {"code", "message"}} wire envelope.
Add writeErrWithLog helper for 500-class errors that need an operator
log line. Migrate all 13 admin_*.go handler files (~76 call sites) to
the new signature; T3 will sweep the remaining api package.

The old 4-arg writeErr is removed, so non-admin call sites in
internal/api will not compile until T3 lands. This is by design — T2
and T3 are paired.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/api/admin_scan_schedule.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 
+	"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/library"
 )
@@ -34,11 +35,10 @@ func (h *handlers) handleGetScanSchedule(w http.ResponseWriter, r *http.Request)
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			h.logger.Error("admin: scan_schedule singleton row missing")
-			writeErr(w, http.StatusInternalServerError, "server_error", "schedule row missing")
+			writeErr(w, apierror.Internal(errors.New("schedule row missing")))
 			return
 		}
-		h.logger.Error("admin: get scan schedule", "err", err)
-		writeErr(w, http.StatusInternalServerError, "server_error", "lookup failed")
+		writeErrWithLog(w, h.logger, "admin: get scan schedule", apierror.Internal(err))
 		return
 	}
 
@@ -48,12 +48,12 @@ func (h *handlers) handleGetScanSchedule(w http.ResponseWriter, r *http.Request)
 func (h *handlers) handlePatchScanSchedule(w http.ResponseWriter, r *http.Request) {
 	var req scanScheduleReq
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeErr(w, http.StatusBadRequest, "bad_body", "invalid JSON")
+		writeErr(w, apierror.BadRequest("bad_body", "invalid JSON"))
 		return
 	}
 
 	if err := validateScheduleReq(&req); err != nil {
-		writeErr(w, http.StatusBadRequest, "validation", err.Error())
+		writeErr(w, apierror.BadRequest("validation", err.Error()))
 		return
 	}
 
@@ -64,8 +64,7 @@ func (h *handlers) handlePatchScanSchedule(w http.ResponseWriter, r *http.Reques
 		TimeOfDay:     req.TimeOfDay,
 		WeeklyDay:     pgInt32Ptr(req.WeeklyDay),
 	}); err != nil {
-		h.logger.Error("admin: update scan schedule", "err", err)
-		writeErr(w, http.StatusInternalServerError, "server_error", "update failed")
+		writeErrWithLog(w, h.logger, "admin: update scan schedule", apierror.Internal(err))
 		return
 	}
 
@@ -73,8 +72,7 @@ func (h *handlers) handlePatchScanSchedule(w http.ResponseWriter, r *http.Reques
 
 	row, err := q.GetScanSchedule(r.Context())
 	if err != nil {
-		h.logger.Error("admin: re-read scan schedule", "err", err)
-		writeErr(w, http.StatusInternalServerError, "server_error", "re-read failed")
+		writeErrWithLog(w, h.logger, "admin: re-read scan schedule", apierror.Internal(err))
 		return
 	}
 	cfg := library.ScheduleConfig{Mode: row.Mode}