fix(security): sanitize sensitive query params in error logs and response urls

[ghzhost]

Summary

This PR addresses issues #282 and #283 by unifying URL sanitization across application access logs, error middleware logs, and 404 / 405 error responses:

1. Error Middleware Logging Sanitization ([Bounty: $70] Sanitize request URLs in error-handler log entries and 404 messages #282):
   • errorHandler now passes request.originalUrl (or request.url) through sanitizeRequestUrl(...) before writing structured log entries, ensuring tokens/keys/seeds in query strings are redacted in error logs.
2. Error Response Sanitization ([Bounty: $70] Sanitize request URLs in error-handler log entries and 404 messages #282):
   • notFoundHandler and attachMethodNotAllowedHandlers now strip query parameters from error response messages (Route not found: GET <path> and Method <method> not allowed for <path>) so sensitive query parameters are never echoed back in client-facing error payloads.
3. Log Sanitizer Normalization & Consistency ([Bounty: $75] Redact case-variant and hyphenated sensitive query keys from request access logs #283):
   • Updated request-logger.ts and app.ts to use standardized uppercase [REDACTED] token and unified the sanitizeRequestUrl helper across both access logging in app.ts and error handling in error.middleware.ts.
   • Added seed to sensitive query parameter keys list alongside wallet_seed, token, secret, api_key, key, access_token, authorization, etc.
   • Handled case-insensitivity and hyphenated variants consistently via key normalization.

Tests Added & Verified

• tests/sanitize-urls-and-logs.test.ts: verified errorHandler query parameter redaction, 404 message URL sanitization, and access log sanitization.
• Full test suite verified (npm test passes 57/57 test files, 263 tests).
• Linting verified (npm run lint).

Closes #282
Closes #283