security: sanitize internal error messages in API responses

- handler_trader.go: remove loadErr.Error() from 500 responses (2 instances)
- handler_ai_cost.go: replace err.Error() with generic message, add logging
- Internal errors now logged server-side, not exposed to clients

api/handler_ai_cost.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"net/http"
+	"nofx/logger"
 
 	"github.com/gin-gonic/gin"
 )
@@ -18,7 +19,8 @@ func (s *Server) handleGetAICosts(c *gin.Context) {
 
 	charges, total, err := s.store.AICharge().GetCharges(traderID, period)
 	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		logger.Infof("❌ Failed to get AI charges for trader %s: %v", traderID, err)
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve AI cost data"})
 		return
 	}
 

api/handler_trader.go

@@ -495,7 +495,7 @@ func (s *Server) handleStartTrader(c *gin.Context) {
 	logger.Infof("🔄 Loading trader %s from database...", traderID)
 	if loadErr := s.traderManager.LoadUserTradersFromStore(s.store, userID); loadErr != nil {
 		logger.Infof("❌ Failed to load user traders: %v", loadErr)
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to load trader: " + loadErr.Error()})
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to load trader configuration"})
 		return
 	}
 
@@ -530,7 +530,8 @@ func (s *Server) handleStartTrader(c *gin.Context) {
 		}
 		// Check if there's a specific load error
 		if loadErr := s.traderManager.GetLoadError(traderID); loadErr != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to load trader: " + loadErr.Error()})
+			logger.Infof("❌ Trader %s load error: %v", traderID, loadErr)
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to load trader, please check configuration"})
 			return
 		}
 		c.JSON(http.StatusNotFound, gin.H{"error": "Failed to load trader, please check AI model, exchange and strategy configuration"})