Error responses inconsistently leak raw error messages

[rohitg00]

Problem

Some functions return raw err.message to callers which could include API keys, file paths, or stack traces. Other endpoints properly mask errors.

Examples

• src/functions/summarize.ts:151 — { success: false, error: msg } leaks raw error
• src/viewer/server.ts:455 — { error: "internal error" } properly masked

Suggested Fix

Standardize all API responses to never include raw error messages. Log details server-side only.