Error-visibility hardening: surface Supabase errors, stop raw-detail leaks

Production incident 04/08/2026: real Supabase errors were invisible.
safeErrorLog/safeErrorMessage flattened PostgrestError plain objects to
the literal "Unexpected error", and 56 route/middleware sites sent the
raw DB/provider error message to the browser while logging nothing
server-side.

- safeError.ts: extract message/code/details/hint from non-Error
  message-bearing objects (known string fields only, always redacted);
  new GENERIC_ERROR_DETAIL constant and failRequest() helper (log
  redacted server-side + fixed generic client detail).
- asyncHandler.ts: use the shared constant.
- middleware/auth.ts: failure paths now console.error (devLog was
  dev-only, so production logged nothing); fixed 401/500 details.
- routes/{chat,projects,documents,tabular,workflows,user}.ts: every
  DB/provider-originated `detail: error.message` send converted to
  failRequest; user.ts 500-status errorMessage catches now log via
  safeErrorLog and send the fixed generic detail.
- New lib/safeError.test.ts: 17 tests pinning extraction, redaction,
  fallbacks and failRequest behaviour.

Hand-written validation details, multer 400s, MCP-connector actionable
errors and redacted SSE stream events left unchanged by design.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>