fix: sanitize auth error causes before sending to WebSocket clients

Previously, internal ServerAuthPairingLinksListError and
ServerAuthSessionsListError objects were passed directly as the cause
field in AuthAccessStreamError, which gets serialized via Schema.Defect()
to WebSocket clients. This leaked internal error chains, stack traces,
and backend details.

Now we wrap the cause in a plain Error with only the message string,
preventing internal details from reaching the client while preserving
the human-readable error description.

Author: cursoragent

apps/server/src/ws.ts

@@ -514,7 +514,7 @@ const makeWsRpcLayer = (currentSession: EnvironmentAuth.AuthenticatedSession) =>
               (cause) =>
                 new AuthAccessStreamError({
                   operation: "list-pairing-links",
-                  cause,
+                  cause: new Error(cause.message),
                 }),
             ),
           ),
@@ -524,7 +524,7 @@ const makeWsRpcLayer = (currentSession: EnvironmentAuth.AuthenticatedSession) =>
                 new AuthAccessStreamError({
                   operation: "list-client-sessions",
                   currentSessionId,
-                  cause,
+                  cause: new Error(cause.message),
                 }),
             ),
           ),