fix: prevent stack trace exposure in flask-playwright API responses

[rajkumar-prog]

Problem

Fixes #1543

The Flask app in evals/elsuite/multistep_web_tasks/docker/flask-playwright/app.py exposes raw exception details directly in API responses at 4 locations:

1. /setup — f"failed to start session (already started?): {e}" leaks exception message
2. /exec_command — "content": str(e) leaks TypeError details
3. /exec_commands — "content": str(e) leaks TypeError details
4. _execute_command() — f"error executing command {command}: {e}" leaks exception + command content

Stack traces and internal error details should never be sent to clients — they expose internal system information that can aid attackers.

Fix

At all 4 locations:

• Log the full exception internally via logger.error() so it's still captured for debugging
• Return a generic, safe message to the API client with no exception details

Changes

• evals/elsuite/multistep_web_tasks/docker/flask-playwright/app.py — 4 locations patched