[SandObserver]

Summary

• Replace every user-facing throw new Error(...) in ui/widgets/{books,nowplaying,backup}/data.js with ctx.fail(message, { kind }). A plain Error is sanitised to a generic message by api/src/api-error.js, so 29 written-for-the-user sentences were being discarded.
• Thread ctx through the Backup helper chain (dupLogin, dupRefresh, dupGetToken, dupFetch, kopiaFetch, duplicatiJobs, kopiaSources, slots) in place of the bare fetchJSON, since none of them could reach ctx.fail before.
• Replace the two empty catch {} blocks in backup/data.js with ctx.log.warn. Behaviour is unchanged — one unreachable instance still leaves its own slots null rather than failing the widget — but the reason is no longer discarded.
• Stop interpolating Navidrome's own error text into a vouched message; a vouched message may carry only words this repo chose.
• Add a guard in api/test/widget-error.test.js asserting no widget reports a user-facing failure with a plain Error. connections is exempt, with the reason recorded: it catches its own throws and surfaces them as a per-service error field inside a successful result, which the convention allows.
• Strip ctx.log.* calls before the existing raw-caught-message scan, so logging a caught error is not mistaken for sending it to the browser.

Testing
All green. Added 1 guard test and updated backup-data.test.js, whose fake ctx now provides fail, KIND and log like the real one. Mutation-checked by reverting one call to a plain throw.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.