fix(backend): sanitize error handler to prevent internal info leak

[DevSolex]

Summary

Fixes the global error handler leaking internal implementation details (raw error messages, stack traces, file paths) to API clients.

Closes #159

Changes

backend/src/api/middleware/errorHandler.ts

• Check NODE_ENV to determine error detail level
• Production: return err.code || 'INTERNAL_SERVER_ERROR' and a safe generic message — never expose raw err.message or stack trace
• Development: return full err.message and err.stack for debugging
• Always log the full error server-side via Pino (err, requestId, path, method)
• Always include requestId and path in every response for traceability

backend/tests/errorHandler.test.ts (new)

12 tests covering all acceptance criteria:

• Production: no raw message leaks, no stack trace, uses err.code when present, falls back to INTERNAL_SERVER_ERROR, respects err.statusCode, always includes requestId and path
• Development: raw message exposed, stack trace exposed, no generic message field, always includes requestId

Test Results

PASS tests/errorHandler.test.ts
  errorHandler — production mode
    ✓ returns a generic error message (no raw err.message)
    ✓ does not include a stack trace
    ✓ uses err.code when present
    ✓ falls back to INTERNAL_SERVER_ERROR when err.code is absent
    ✓ respects err.statusCode
    ✓ always includes requestId in the response
    ✓ always includes path in the response
  errorHandler — development mode
    ✓ includes the raw error message
    ✓ includes the stack trace
    ✓ does not include a generic message field
    ✓ always includes requestId in the response

Acceptance Criteria

• Check NODE_ENV to determine error detail level
• Production: return generic error code, not raw message
• Development: return full error message and stack trace
• Always log full error server-side via Pino
• Always include requestId in the response for debugging
• Test: verify no internal details leak in production mode
• Test: verify full details available in development mode

[vercel]

@DevSolex is attempting to deploy a commit to the Jaja's projects Team on Vercel.

A member of the Team first needs to authorize it.

[devJaja]

LGTM @DevSolex

[DevSolex]

LGTM @DevSolex

Appreciate the review!