fix: replace error.message with generic "Internal server error" in all API catch blocks

Prevents leaking internal error details to clients across 7 route files:
health, candles, annotations, annotations/[id], upload, export, span-annotations/export.
Server-side console.error logging preserved for debugging.

Closes task 4.6.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/app/api/candles/route.ts

@@ -36,8 +36,9 @@ export async function GET(request: NextRequest) {
 
     return NextResponse.json(normalized);
   } catch (error: any) {
+    console.error(error);
     return NextResponse.json(
-      { error: error.message || 'Failed to fetch candles' },
+      { error: 'Internal server error' },
       { status: 500 }
     );
   }