fix(12): IN-01 return generic error from /validate/oidc instead of raw network detail

The catch block previously echoed err.message (which may contain internal
network addresses like ECONNREFUSED 192.168.1.50:9091) to the pre-auth
caller. Log the raw message server-side only and return a generic user-
facing string with no internal network detail.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/routes/setup.ts

@@ -179,10 +179,10 @@ setupRouter.post('/validate/oidc', async (c) => {
     }
     return c.json({ ok: true }, 200);
   } catch (err) {
-    return c.json({
-      ok: false,
-      error: 'OIDC discovery failed: ' + (err instanceof Error ? err.message : String(err)),
-    }, 400);
+    // IN-01: Log raw error server-side only — do not echo internal network detail
+    // (e.g. "connect ECONNREFUSED 192.168.1.50:9091") to the pre-auth caller.
+    console.error('[setup/validate/oidc]', err instanceof Error ? err.message : String(err));
+    return c.json({ ok: false, error: 'OIDC discovery failed. Check the issuer URL.' }, 400);
   }
 });