Adopt typed HTTP errors across route handlers

Commit notes

Convert 229 user-facing 'throw new Error(...)' sites in routes to NotFoundError (140), BadRequestError (53), ForbiddenError (21), and ConflictError (15) so clients get 4xx statuses instead of 500s with suppressed messages. Server/config faults and webhook-handler throws deliberately remain plain Error (5xx) so Stripe retries. Messages are unchanged.

[private session redacted]