feat: add request-scoped error presentation

[peterkc]

Summary

• Add an opt-in request-context policy to ErrorHandler. Applications can suppress new cause/stack log fields and replace a 400 message. Defaults, error classification and non-400 responses stay unchanged.
• Add ComposeErrorPresentationPolicies for independent application rules. All rules run in order; suppression combines with OR and the first non-nil message wins, including an empty string. Message selection never skips later privacy rules.
• The composer snapshots its policy list and returns independent results. Attaching a context policy still replaces the previous policy rather than adding to it.

ErrorHandler -> composed policy
                 +-- privacy rule
                 +-- message rule
                 +-- fallback rule
                 |
                 v
              merged result -> logging / response decisions

Verification

Passed locally with Go 1.26.6:

• make fmt
• make lint
• make test (race tests)
• go build -v ./...

Tests cover default behavior, error precedence, headers, ordered composition, nil/empty results, ownership and concurrent use. The split-rule regression proves that an early message rule cannot bypass later suppression. Bounded duplication analysis found no new production duplication.

Local CodeRabbit reviewed all three changed files against the PR base and reported no findings. CI success is not yet established.

Review notes

Suppression affects only this ErrorHandler invocation's new cause/stack fields. Earlier fields and other log events remain unchanged. A replacement 400 message omits detailed fields; this is not general log redaction. Child policies must remain safe for concurrent use.

[bir]

declined. We can review a model for redaction later.