How should API routes handle errors without leaking internals?