[audit][P1][security] core: initErrorRoutes leaks err.message/code to clients in production

[PierreBrisorgueil]

Finding NODE-CORE-01
File lib/services/express.js:313-321

The global error handler sends { message: err.message, code: err.code } unconditionally — no NODE_ENV guard, unlike responses.error (responses.js:100). Controllers next(err) raw Mongoose errors (e.g. E11000 ... index: email_1), leaking internals in prod.

Fix In production send only { message: 'Internal Server Error' }; or funnel all errors through responses.error for one sanitization path.

Devkit Node clean audit 2026-05-29 (rev d42eb12). Verified real by an independent refute-by-default reviewer. Fix flows through /feature #N → /verify-qa → /pull-request-finalize.

[PierreBrisorgueil]

Reclassé P2 later (2026-05-29). Direction : maintenant que PostHog est dans la stack, les erreurs serveur non gérées doivent partir vers PostHog (transport) ET le retour client doit être sanitizé en prod (générique). Grosse issue cross-cutting, à planifier séparément.