[SandObserver]

Summary

• Replace out.error = e.code || e.message, out.error = e.message and o.error = e.message || String(e) in ui/widgets/connections/data.js with a local errorText(e): the widget's own sentence when it wrote one, otherwise a phrase chosen from the error code (connection refused, host not found, timed out, connection lost, certificate rejected, unreachable). A caught message is never used.
• Convert the file's 15 throw new Error(...) sentences to ctx.fail(...) with a kind, which is what marks a message as vouched and lets the catch tell it apart from one Node threw. vpnView and mapView take ctx instead of (config, fetchJSON).
• SsrfBlockedError keeps its own message: it is a sentence this repo wrote, and the reason is the point of it.
• Remove the connections exemption from the plain-Error guard added in Fix: report Books, Now Playing and Backup failures in the widget's own words #10, so that rule now covers every widget.
• Add a guard asserting no widget writes e.message, e.stack or String(e) into a result's error field.

Why it mattered: an error field inside a successful result is a legitimate pattern here, and one dead service should not fail the whole widget. But a 200 body never passes through api-error.js, which exists precisely because an arbitrary error message names a host, a path or an upstream body. So the sanitisation the failure path gets was absent on this one.

Testing
All green, coverage floor held. Added 1 guard test and updated connections-url.test.js, whose fake ctx now provides fail and KIND like the real one. Mutation-checked twice: restoring out.error = e.message and reverting one ctx.fail to a plain throw each fail.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.