Use AppError with proper status codes everywhere

Services are inconsistent about error types: some throw AppError with a status code, others throw plain Error, which the error handler turns into a generic 500. So identical problems surface differently depending on which code path hit them.

• Sweep the services and replace bare new Error(...) with AppError and the right status (400 for bad input, 404 for missing things, 502-ish for upstream Spotify failures)
• Add a lint rule (no-restricted-syntax or similar) so plain throws don't creep back in