fix: replace raw exception strings in HTTP responses (CWE-209)

[Copilot]

Raw str(exc) / str(e) values were being stored in state objects that get serialised and returned to HTTP clients, leaking internal implementation details (file paths, class names, internal logic) via GET /api/user-scanner/full-scan/status and the unauthenticated GET /api/settings endpoint.

Changes

• simple_org_chart/app_main.py — three call sites replaced with generic error strings:
  • _background_full_scan: scan state dict error field
  • trigger_update: mark_data_update_finished error arg
  • clear_cached_data: mark_data_update_finished error arg

# Before
st['error'] = str(exc)
mark_data_update_finished(success=False, error=str(e), source='manual')

# After
st['error'] = 'An internal error occurred during the scan.'
mark_data_update_finished(success=False, error='An internal error occurred.', source='manual')

Server-side logger.error(...) calls are preserved in all three locations, so full exception details remain available to operators in logs.