fix: prevent stack trace exposure in SSE error responses

Log exception details server-side only; send generic error messages
to clients via SSE streams to resolve code scanning alerts.

py/api/autotag_routes.py

@@ -142,7 +142,8 @@ class AutotagRoutesMixin:
                         None, lambda: service.load_model(model_type, use_gpu)
                     )
                 except Exception as e:
-                    yield f"data: {json.dumps({'type': 'error', 'message': f'Failed to load model: {str(e)}'})}\n\n"
+                    self.logger.error(f"Failed to load model: {e}")
+                    yield f"data: {json.dumps({'type': 'error', 'message': 'Failed to load model. Check server logs for details.'})}\n\n"
                     return
 
                 if custom_prompt:

py/api/images.py

@@ -777,16 +777,18 @@ class ImageRoutesMixin:
                                 )
 
                     except Exception as e:
-                        error_msg = f"Failed to generate thumbnail for {media_file.name}: {str(e)}"
+                        self.logger.warning(
+                            f"Failed to generate thumbnail for {media_file.name}: {e}"
+                        )
+                        error_msg = f"Failed to generate thumbnail for {media_file.name}"
                         errors.append(error_msg)
-                        self.logger.warning(error_msg)
 
                         if len(errors) <= 5:
                             await send_progress(
                                 "status",
                                 {
                                     "phase": "processing",
-                                    "message": f"Error processing {media_file.name}: {str(e)}",
+                                    "message": f"Error processing {media_file.name}",
                                 },
                             )