How should API routes handle unexpected errors without leaking internals?