feat: expanded health checks, deploy filtering, per-project notifications, error sanitization, and audit trail

- Expand health endpoint to check DB, Docker, and NPM connectivity (FUNC-M4)
- Add project_id, stage_id, offset query params to deploys endpoint (FUNC-M5, FUNC-M6)
- Add notification_url field to Stage model for per-project overrides (FUNC-M2)
- Add NPM Ping method for health checking
- Sanitize all internal error messages in API handlers (SEC-M4)
- Add audit trail events for admin actions (FUNC-M3)
- Add EventLog event type to event bus

internal/api/sse.go

@@ -35,7 +35,8 @@ func (s *Server) streamDeployLogs(w http.ResponseWriter, r *http.Request) {
 			respondNotFound(w, "deploy")
 			return
 		}
-		respondError(w, http.StatusInternalServerError, "failed to get deploy: "+err.Error())
+		slog.Error("failed to get deploy", "error", err)
+		respondError(w, http.StatusInternalServerError, "internal server error")
 		return
 	}
 
@@ -44,7 +45,8 @@ func (s *Server) streamDeployLogs(w http.ResponseWriter, r *http.Request) {
 	if !strings.Contains(accept, "text/event-stream") {
 		logs, err := s.store.GetDeployLogs(deployID)
 		if err != nil {
-			respondError(w, http.StatusInternalServerError, "failed to get deploy logs: "+err.Error())
+			slog.Error("failed to get deploy logs", "error", err)
+			respondError(w, http.StatusInternalServerError, "internal server error")
 			return
 		}
 		respondJSON(w, http.StatusOK, logs)