fix(api): drop err.message from 500 response body (CWE-209)

Catch-all error handlers in lib/api/errors.js and server.js were
echoing raw err.message to clients. Replace with a fixed generic
message; the full error continues to be logged server-side via pino.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

server.js

@@ -27,7 +27,7 @@ export function createApp() {
 
   app.use((err, _req, res, _next) => {
     log.error({ err }, 'unhandled');
-    res.status(500).json({ error: { code: 'internal', message: err.message } });
+    res.status(500).json({ error: { code: 'internal', message: 'internal server error' } });
   });
 
   return app;