[Security][MEDIUM] Internal error details exposed in HTTP error responses

## Summary

Harper can surface raw internal error messages — including JavaScript exception text and internal property names — in HTTP error responses. This discloses implementation details to callers, potentially including unauthenticated users.

## Risk

Exposing raw error messages allows an attacker to:

- Map internal code paths and call-site structure
- Identify technology stack details
- Discover injection points or gaps in error-handling logic

## Recommendation

- HTTP error responses should return a generic, user-facing message only (e.g. `{"error": "internal server error"}`).
- Full error detail — including stack traces, exception messages, and variable names — should be logged server-side only and never included in HTTP response bodies.
- Apply this consistently across all request handlers and middleware.

## Severity

**Medium** — information disclosure that meaningfully aids further attack planning.