feat(middleware): sanitize sensitive fields from error responses

[slsgzs-cloud]

Summary

Fixes #4.

Adds a structured error-response sanitizer that strips sensitive fields from JSON error responses before they leave the Arbellar Backend.

Changes

New: src/middleware/errorResponse.ts

Pure, unit-testable helper:

sanitizeErrorDetails(details) -> sanitized details

Deny-list (case-insensitive, recursive, arrays handled):
password, passwordHash, secret, token, apiKey, privateKey, private_key, keypair, seed, mnemonic, jwt, authorization, mongodbUri, connectionString, uri, cursor, stackTrace, stack, internal, env, process

Updated: src/middleware/errorHandler.ts

Passes details through sanitizeErrorDetails() before attaching to the response. Existing success: false + error.code / error.message / error.details shape is preserved. Dev stack exposure unchanged.

Updated: src/middleware/index.ts

Exports the new errorResponse module.

New: tests/unit/middleware/errorResponse.test.ts

10 test cases covering:

• Top-level deny-listed keys
• Nested deny-listed keys
• Arrays with deny-listed keys
• Non-object input (null, undefined, primitives)
• Deeply nested recursive sanitization
• Case-insensitive key matching
• Top-level arrays
• Nested arrays
• Input immutability
• Empty objects

Acceptance Criteria

• sanitizeErrorDetails added as pure helper
• Deny-listed keys stripped at top level and nested levels
• errorHandler applies the helper to details
• Existing response shape preserved
• Unit tests cover all listed cases

Verification

pnpm test
pnpm lint
pnpm typecheck
pnpm format:check

CI will validate on merge.