security: sanitize error messages returned to HTTP clients

[dobby-coder]

This issue tracks a hardening task identified in a security review. See the linked security advisory for details: https://github.com/encryption4all/postguard/security/advisories/GHSA-c2rq-r4h4-xr73

[dobby-coder]

/dobby fix — In pg-pkg/src/error.rs, update the ResponseError::error_response() implementation so that internal-only error variants (specifically Error::Prometheus) return a generic client message like "internal server error" instead of format!("{}", self). The full error should continue to be logged server-side but must not be forwarded to HTTP response bodies.

[dobby-coder]

On it! I'm picking up the fix for to mask internal errors in HTTP responses and will open a draft PR on .

[dobby-coder]

On it! I'll update to strip internal error details from HTTP responses and open a draft PR for review.