fix: standardize error response format to { message } across all endpoints

[jakebromberg]

Summary

• errorHandler.ts: Non-WxycError errors no longer leak raw error.message to clients — they now return { message: 'Internal server error' } and log the real error via console.error
• library/flowsheet/djs controllers: Replaced all res.send('plain string') calls with res.json({ message: '...' }) and removed the extra status field from { status, message } response objects
• New test suite at tests/unit/middleware/errorHandler.test.ts covering both WxycError and non-WxycError paths

Test plan

• Unit tests verify WxycError returns { message } with correct status code
• Unit tests verify non-WxycError returns generic { message: 'Internal server error' } (previously leaked raw message)
• Unit tests verify non-Error thrown values are handled
• Unit tests verify console.error is called for unhandled errors
• Full unit test suite passes (124 tests, 9 suites)

Made with Cursor