fix(api): sanitize database constraint errors before sending to clients

Closes #914

Previously DbError::ConstraintViolation passed the raw sqlx error message
(e.g. "duplicate key value violates unique constraint
newsletter_subscribers_email_key") directly into the 409 response body,
leaking table and column names to API consumers.

Now the full constraint message is logged internally at ERROR level (where
it remains visible to operators via the tracing correlation ID) and replaced
with a generic client-safe message in the response body.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: victorisiguzoruzoma874

services/api/src/handlers.rs

@@ -92,7 +92,8 @@ fn into_api_error(err: anyhow::Error) -> ApiError {
                 return ApiError::service_unavailable("database connection pool exhausted");
             }
             DbError::ConstraintViolation(msg) => {
-                return ApiError::conflict(msg.clone());
+                tracing::error!(db_constraint = %msg, "database constraint violation");
+                return ApiError::conflict("A record with this value already exists.");
             }
             DbError::Other(_) => {}
         }