Return every error as {"error": "..."}

Echo errors, middleware and handlers used three different formats (message object, error object, bare string). One error handler now writes all of them the same way; status codes are unchanged.

internal/server/middleware/token_auth.go

@@ -28,11 +28,11 @@ func TokenAuth(q repository.Querier, disabled bool) echo.MiddlewareFunc {
 			}
 
 			if c.Request().Header.Get("Authorization") == "" {
-				return c.JSON(http.StatusUnauthorized, map[string]string{"error": "Authorization header required"})
+				return echo.NewHTTPError(http.StatusUnauthorized, "Authorization header required")
 			}
 			token, ok := BearerToken(c)
 			if !ok {
-				return c.JSON(http.StatusUnauthorized, map[string]string{"error": "Invalid authorization format. Use: Bearer <token>"})
+				return echo.NewHTTPError(http.StatusUnauthorized, "Invalid authorization format. Use: Bearer <token>")
 			}
 
 			ctx := c.Request().Context()
@@ -42,7 +42,7 @@ func TokenAuth(q repository.Querier, disabled bool) echo.MiddlewareFunc {
 					zap.String("ip", c.RealIP()),
 					zap.String("error", err.Error()),
 				)
-				return c.JSON(http.StatusUnauthorized, map[string]string{"error": "Invalid or expired token"})
+				return echo.NewHTTPError(http.StatusUnauthorized, "Invalid or expired token")
 			}
 
 			if time.Now().After(session.ExpiresAt.Time) {
@@ -52,7 +52,7 @@ func TokenAuth(q repository.Querier, disabled bool) echo.MiddlewareFunc {
 						logging.GetLogger().Error("Failed to delete expired session", zap.Error(err))
 					}
 				}(context.WithoutCancel(ctx))
-				return c.JSON(http.StatusUnauthorized, map[string]string{"error": "Token expired"})
+				return echo.NewHTTPError(http.StatusUnauthorized, "Token expired")
 			}
 
 			c.Set("session", session)