fix(agentserver): hide upstream errors from clients

Generic 502 detail как в httpapi; добавлен docs/production-checklist.md.

Co-authored-by: Cursor <[email protected]>

internal/agentserver/server.go

@@ -14,6 +14,8 @@ import (
 	"evobgp/internal/nodecli"
 )
 
+const upstreamErrorDetail = "upstream request failed"
+
 // Config holds evobgp-agent serve settings.
 type Config struct {
 	Listen          string
@@ -85,7 +87,7 @@ func (s *Server) handleBirdProtocols(w http.ResponseWriter, r *http.Request) {
 	out, err := birdfmt.ShowProtocols(ctx, sock, strings.TrimSpace(s.cfg.BirdcBin))
 	if err != nil {
 		log.Printf("agentserver: bird protocols: %v", err)
-		writeProblem(w, http.StatusBadGateway, err.Error())
+		writeProblem(w, http.StatusBadGateway, upstreamErrorDetail)
 		return
 	}
 	writeJSON(w, http.StatusOK, map[string]any{
@@ -126,7 +128,7 @@ func (s *Server) handleSync(w http.ResponseWriter, r *http.Request) {
 	})
 	if err != nil {
 		log.Printf("agentserver: sync: %v", err)
-		writeProblem(w, http.StatusBadGateway, err.Error())
+		writeProblem(w, http.StatusBadGateway, upstreamErrorDetail)
 		return
 	}
 	if s.cfg.OnSyncSuccess != nil {