Avoid leaking backend error details in HTTP responses

[folbricht]

Summary

The chunk-server and index-server HTTP handlers echoed raw upstream-store errors and store identifiers into response bodies. On an Internet-exposed server that leaks backend detail to clients:

• Backend errors from S3/SFTP/GCS/local stores (which can contain bucket names, hostnames, filesystem paths, or occasionally signed URLs) were written to the response body on 5xx and some 4xx paths.
• The upstream store URI was written to the body of writing to upstream ... is not enabled and upstream ... does not support writing responses.

Changes

All error paths that previously emitted backend-derived text to the client now:

• log the full error to stderr (so operators retain diagnostics), and
• return a generic message to the client.

Client-input errors remain intact since they describe the caller's own request:

• chunk hash-mismatch from NewChunkFromStorage (PUT chunk)
• invalid index: ... from IndexFromReader (PUT index)
• URL-shape validation errors from idFromPath

Status codes are preserved; only the response body is changed. The returned error from validateWritable still contains the store identifier for the server-side caller, but the HTTP response no longer does.

Existing chunk-server / index-server tests pass unchanged.