security: code-review API returns raw str(e) exception messages to clients (five routes)

[ionfwsrijan]

Summary

The code-review API returns raw Python exception messages to clients. Five routes serialize str(e) directly into JSON error responses, leaking internal error details (exception strings, sometimes internal state/values) to unauthenticated callers. This is distinct from #653 (which covered the recommendation API leaking server file paths): the code-review endpoints surface str(e) verbatim in five separate places.

Evidence

src/routes/main_routes.py:

710: return jsonify({"error": str(e)}), 400
778: return jsonify({"error": str(e)}), 404
812: return jsonify({"error": str(e)}), 404
845: return jsonify({"error": str(e)}), 400
873: return jsonify({"error": str(e)}), 404

These belong to /api/code-review/... routes: submit (line 710), submission lookup (778), review lookup (812), score-category (845), and complete (873). A raised exception's message — e.g. ValueError("Review ... not found") from code_review.py, or any unforeseen runtime error — is emitted to the client verbatim.

Impact

• Information disclosure: internal exception strings (including method names, IDs, and values) are exposed to any caller.
• Makes debugging harder for users and gives attackers a fingerprint of the internal implementation.

Suggested Fix

Return a generic message for the error body (log the real exception server-side via current_app.logger), e.g. jsonify({"error": "An internal error occurred."}) while keeping status codes meaningful.