fix: redact production error logs

[sanphandinh]

Summary

• sanitize production error-handler logs so raw error messages and stacks are not serialized to application logs
• keep verbose local/development logging behavior unchanged
• add a focused regression test proving a secret-looking error message is omitted while the public 500 response remains generic

Demo

• Short demo video: https://files.catbox.moe/3lxhnf.mp4

Verification

• node --test apps/api/src/tests/errorHandler.test.js
• node --test apps/api/src/tests/*.test.js -> 2 passed when run outside the sandbox because the existing health test opens a localhost listener
• node --check apps/api/src/middleware/errorHandler.js
• node --check apps/api/src/tests/errorHandler.test.js
• git diff --check

Note: npm run test -w apps/api still fails because the existing package script invokes node --test src/tests, which Node treats as a missing module path in this checkout. I used the direct test file glob above to validate this patch.

Closes #3359
/claim #743