refactor(server/api): writeErr accepts error; migrate admin handlers (1/3)

Rewrite writeErr(w, err) to wrap *apierror.Error via apierror.From,
preserving the existing {"error": {"code", "message"}} wire envelope.
Add writeErrWithLog helper for 500-class errors that need an operator
log line. Migrate all 13 admin_*.go handler files (~76 call sites) to
the new signature; T3 will sweep the remaining api package.

The old 4-arg writeErr is removed, so non-admin call sites in
internal/api will not compile until T3 lands. This is by design — T2
and T3 are paired.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/api/admin_tracks.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
+	"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/tracks"
 )
@@ -40,7 +41,7 @@ func (h *handlers) handleRemoveTrack(w http.ResponseWriter, r *http.Request) {
 		// the spec's error surface — collapse both to 404 not_found so
 		// the client doesn't have to handle a separate bad_request branch
 		// for a code path that's only reachable via UI bugs.
-		writeErr(w, http.StatusNotFound, "not_found", "track not found")
+		writeErr(w, &apierror.Error{Status: http.StatusNotFound, Code: "not_found", Message: "track not found"})
 		return
 	}
 
@@ -55,7 +56,7 @@ func (h *handlers) handleRemoveTrack(w http.ResponseWriter, r *http.Request) {
 	if !ok {
 		// Defensive: RequireUser+RequireAdmin should have run upstream.
 		// If we got here without a user in context the routing is broken.
-		writeErr(w, http.StatusUnauthorized, "unauthenticated", "no session")
+		writeErr(w, apierror.Unauthorized("unauthenticated", "no session"))
 		return
 	}
 
@@ -64,11 +65,11 @@ func (h *handlers) handleRemoveTrack(w http.ResponseWriter, r *http.Request) {
 	)
 	if err != nil {
 		if errors.Is(err, tracks.ErrNotFound) {
-			writeErr(w, http.StatusNotFound, "not_found", "track not found")
+			writeErr(w, &apierror.Error{Status: http.StatusNotFound, Code: "not_found", Message: "track not found"})
 			return
 		}
 		h.logger.Error("api: remove track failed", "err", err, "track_id", idStr)
-		writeErr(w, http.StatusInternalServerError, "server_error", "remove failed")
+		writeErr(w, apierror.Internal(err))
 		return
 	}