Wrap errors with %w when returning them

Many places where we return errors don't use the %w wrapping, because
they predate that functionality.

This patch changes those to use %w, so callers can inspect the
underlying errors with errors.Is and errors.As if needed in the future.

The text of the errors does not change, and no existing callers inspect
these errors, so there are no behaviour changes.

internal/userdb/userdb.go

@@ -161,7 +161,7 @@ func (db *DB) AddUser(name, plainPassword string) error {
 	s.Encrypted, err = scrypt.Key([]byte(plainPassword), s.Salt,
 		1<<s.LogN, int(s.R), int(s.P), int(s.KeyLen))
 	if err != nil {
-		return fmt.Errorf("scrypt failed: %v", err)
+		return fmt.Errorf("scrypt failed: %w", err)
 	}
 
 	db.mu.Lock()