Bottle apps send exception text to clients on 500 by default #35

Found by the sprint review (#34), deferred because it changes what clients see.

bottle_error_handler (the default for mk_app apps, which are always Bottle) answers a 500 with {"error": str(error)} unless the OPAQUE_ERRORS environment variable is set. Exception messages routinely carry file paths, connection strings or fragments of data, so by default a py2http service sends them to any client. The aiohttp handler already hides them; i2mint/qh did the same in i2mint/qh#18 (a generic message with an error id, the exception logged server-side under that id).

handle_error in service.py also prints every traceback to stdout, on top of the logger (#1 covers the prints).

Options:

1. Flip the default: hide 500 text unless expose_errors=True (a config key, or the env var), and log the exception with an error id that the client gets. Clients that display error from a 500 would see the generic message instead.
2. Keep sending the text, and document OPAQUE_ERRORS in the README as the production setting.

The aiohttp path (aiohttp_error_handler) is unreachable from mk_app today (_get_framework refuses anything but Bottle, see #7), so only Bottle matters here.

🤖 Generated with Claude Code