Address security review notes

- log only the error name for rejected 4xx requests (JSON.parse messages
  can quote the request body, e.g. a password)
- refuse LB_DATABASE_PATH in production; it is test-only
- fix two stale file references in the skill texts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/server/middleware/error.middleware.ts

@@ -24,11 +24,13 @@ export function errorMiddleware(
 ) {
   const status = clientErrorStatus(error);
   if (status !== undefined) {
+    // No error message here: JSON.parse messages can quote parts of the body
+    // (for example a password from a malformed login request).
     logger.warn("request rejected", {
       method: req.method,
       path: req.originalUrl,
       status,
-      ...toErrorMeta(error),
+      errorName: error instanceof Error ? error.name : typeof error,
     });
     res.status(status).json({ error: "Ungültige Anfrage." });
     return;