fix(server): stop exposing named defects

[nexxeln]

summary

• return the generic safe 500 body for NamedError defects instead of exposing their serialized payload
• add middleware coverage that proves named defects do not leak internal messages

testing

• bun test test/server/httpapi-error-middleware.test.ts --timeout 30000
• bun typecheck