refactor(server/api): writeErr accepts error; migrate admin handlers (1/3)

Rewrite writeErr(w, err) to wrap *apierror.Error via apierror.From,
preserving the existing {"error": {"code", "message"}} wire envelope.
Add writeErrWithLog helper for 500-class errors that need an operator
log line. Migrate all 13 admin_*.go handler files (~76 call sites) to
the new signature; T3 will sweep the remaining api package.

The old 4-arg writeErr is removed, so non-admin call sites in
internal/api will not compile until T3 lands. This is by design — T2
and T3 are paired.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/api/errors.go

@@ -2,11 +2,18 @@ package api
 
 import (
 	"encoding/json"
+	"log/slog"
 	"net/http"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
 )
 
-// errorBody is the JSON envelope for failures on /api/*. Kept separate from
-// the Subsonic envelope so native clients don't have to parse two shapes.
+// errorBody / errorPayload preserve the existing wire envelope:
+//
+//	{"error": {"code": "...", "message": "..."}}
+//
+// Kept separate from the Subsonic envelope so native clients don't have
+// to parse two shapes.
 type errorBody struct {
 	Error errorPayload `json:"error"`
 }
@@ -16,12 +23,26 @@ type errorPayload struct {
 	Message string `json:"message"`
 }
 
-// writeErr is the canonical way to emit a failure. Code is a stable
-// short-string clients can switch on; message is human-readable.
-func writeErr(w http.ResponseWriter, status int, code, message string) {
+// writeErr emits the failure envelope for err. If err is or wraps
+// *apierror.Error, its Status/Code/Message drive the response;
+// otherwise it's mapped to a 500 server_error.
+func writeErr(w http.ResponseWriter, err error) {
+	apiErr := apierror.From(err)
 	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(status)
-	_ = json.NewEncoder(w).Encode(errorBody{Error: errorPayload{Code: code, Message: message}})
+	w.WriteHeader(apiErr.Status)
+	_ = json.NewEncoder(w).Encode(errorBody{Error: errorPayload{
+		Code:    apiErr.Code,
+		Message: apiErr.Message,
+	}})
+}
+
+// writeErrWithLog logs the error at Error level and writes the response.
+// Use for 500-class errors where the operator needs the cause in logs.
+func writeErrWithLog(w http.ResponseWriter, logger *slog.Logger, msg string, err error) {
+	if logger != nil {
+		logger.Error(msg, "err", err)
+	}
+	writeErr(w, err)
 }
 
 // writeJSON emits a 2xx response with the given body JSON-encoded. Mirrors