security: sanitize internal error messages in API responses

- handler_trader.go: remove loadErr.Error() from 500 responses (2 instances)
- handler_ai_cost.go: replace err.Error() with generic message, add logging
- Internal errors now logged server-side, not exposed to clients

api/handler_ai_cost.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"net/http"
+	"nofx/logger"
 
 	"github.com/gin-gonic/gin"
 )
@@ -18,7 +19,8 @@ func (s *Server) handleGetAICosts(c *gin.Context) {
 
 	charges, total, err := s.store.AICharge().GetCharges(traderID, period)
 	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		logger.Infof("❌ Failed to get AI charges for trader %s: %v", traderID, err)
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve AI cost data"})
 		return
 	}