fix: remediate Worker CodeQL alerts

[leocuisine]

Summary

• replace the two trailing-slash regexes flagged for polynomial behavior with a bounded string helper
• stop returning caught exception details to API clients while retaining server-side logging

Closes CodeQL alerts #9, #10, and #11.

Verification

• npx prettier . --check — passed
• npx wrangler deploy --dry-run — passed; produced a 10.17 KiB bundle
• git diff --check — passed

The Worker API routes, success payloads, and status codes are unchanged.