Add sanitizeError() helper that strips file paths, stack traces, SQLite errors, and system errors from messages before returning them to clients. Applied to all route-level catch blocks in payments, queue, fights, and admin routes. Includes 12 tests for the sanitizer and static analysis test verifying no route files leak raw err.message. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>