fix(server): stop relaying upstream and JS error text to the client

Ported onto the split provider layout: the routes now live in
server/providers/openai/{hud-summary,realtime}.js and the camera health
entry in server/providers/cctv.js.

The routes #263 names — celestrak, terrain, adsbdb — were sanitized by
#289. The same defect had moved:

- /api/openai/hud-summary relayed `data.error.message` verbatim on a
  non-ok upstream. That is OpenAI's own error text, carrying request ids,
  organization hints and quota wording. Its catch echoed the JS error too.
- /api/realtime/token echoed the JS error when minting failed, which for a
  network fault is a resolver message naming the upstream host.
- cctvProxy stored the raw error as a camera's health `message`. This is
  the least obvious of the three and the reason the PR is worth its size:
  GET /api/cctv/health serializes `message`, and src/layers/cctv/frames.js
  renders it as the camera's status label, so the detail reached the
  screen through a different door than the sanitized 502 beside it.

Logs name the failure and the upstream status without the text, matching
the Launch Library and terrain paths; these lines get pasted into issues.

Coverage extends the existing harnesses rather than adding files —
localServices.test.mjs drives both OpenAI routes over a mocked upstream,
mediaProviders.test.mjs drives a failing media fetch and then reads
/health. All three assertions fail on the previous implementation.

Refs #263. Does not touch /api/realtime/debug-log's identical echo; that
route is the subject of the #23 PR, so the two do not overlap a line.

server/providers/openai/hud-summary.js

@@ -78,20 +78,23 @@ async function handleHudSummary(req, res) {
     res.statusCode = response.ok && summary ? 200 : response.status || 502;
     res.setHeader('Content-Type', 'application/json; charset=utf-8');
     res.setHeader('Cache-Control', 'no-store');
+    if (!response.ok)
+      console.warn(`[hud-summary] upstream HTTP ${response.status}`);
     res.end(
       JSON.stringify({
         summary: summary || null,
-        error: response.ok
-          ? null
-          : data.error?.message || 'OpenAI HUD summary request failed',
+        // Never relay `data.error.message`: that is OpenAI's own wording, and
+        // it carries request ids, organization hints and quota phrasing.
+        error: response.ok ? null : 'OpenAI HUD summary request failed',
       }),
     );
-  } catch (error) {
+  } catch {
+    console.warn('[hud-summary] request failed');
     res.statusCode = 502;
     res.setHeader('Content-Type', 'application/json');
     res.end(
       JSON.stringify({
-        error: error?.message || 'OpenAI HUD summary request failed',
+        error: 'OpenAI HUD summary request failed',
       }),
     );
   }

server/providers/openai/realtime.js

@@ -146,12 +146,15 @@ function createRealtimeTokenHandler({
         res.setHeader('X-GEV-Voice-Tier-Fallback', '1');
       }
       res.end(body);
-    } catch (error) {
+    } catch {
+      // For a network fault this was a resolver message naming the upstream
+      // host; the client only needs to know the mint failed.
+      console.warn('[realtime-token] mint failed');
       res.statusCode = 502;
       res.setHeader('Content-Type', 'application/json');
       res.end(
         JSON.stringify({
-          error: error?.message || 'Failed to create Realtime token',
+          error: 'Failed to create Realtime token',
         }),
       );
     }