fix(activation-service): stop leaking internal errors, drop unused KYC_PUBLIC_KEY

[sameh-farouk]

Two follow-ups from #1105. Based on #1105, not development — the readme text here describes ACTIVATION_AMOUNT as being read, which only becomes true with that PR. Retarget to development once it merges.

1. Internal error messages were returned to callers

The error middleware computed http-errors' expose flag and then ignored it. Both branches of the NODE_ENV check sent the message anyway, because lodash's omit(err, ['stack']) copies message through:

omit(httpError(500, 'Insufficient Balance Error: ...'), ['stack'])
// => {"message":"Insufficient Balance Error: ...","status":500,"statusCode":500,"expose":false}
//                                                                              ^^^^^^^^^^^^^^

And the development branch — the default, since NODE_ENV is set in neither the Dockerfile nor the chart — sent the whole error including the stack trace. So every deployment has been running in the more verbose mode.

Verified against the built image: a request that failed because the funding account was empty replied with Insufficient Balance Error: Failed to apply 'transfer' on section 'balances' with args '<address>,1000000.

Now the flag decides. 4xx keeps its message, since the caller sent something unusable and needs to know what; 5xx returns the generic status text and the real error goes to the log only:

400 -> {"message":"substrateAccountID is not a valid account id"}
500 -> {"message":"Internal Server Error"}        # log: "error happened handling the request"

NODE_ENV no longer affects what is returned, so a deployment cannot leak by omitting it — which is what every deployment currently does.

Behaviour change: response bodies are now consistently { message }. 4xx previously also carried status, statusCode and expose; non-http errors fell through to res.send(err.message) as text rather than JSON. The frontend catches errors and renders a fixed string without reading the body, so there is no UI impact.

2. KYC_PUBLIC_KEY was required but unread

It has been in bin/www's required env variables since the service was written, but nothing reads it: the signature verification was commented out years ago and its only caller, POST /activation/create-entity, was removed in #1103 as an unauthenticated route that signed a fee-paying extrinsic from the service wallet. Requiring an unused variable only gives the service a reason to refuse to start.

Removed from the required list, the chart and the documented .env. Re-add it alongside the verification code if KYC checks return.

While in the readme, two claims that no longer held: it documented the removed /activation/create-entity endpoint, and said activation "puts 500 tokens" on an account — true in 2021, since reduced by three orders of magnitude.

Verification

• lint + unit: 27/27
• live devnet: 400 exposes its message, 500 returns Internal Server Error while the underlying error still reaches the log, boot and SIGTERM unaffected

🤖 Generated with Claude Code

https://claude.ai/code/session_011YKJm3zuWdSepriT9KL9zy

[sameh-farouk]

Superseded by #1109. GitHub closed this automatically when #1105 merged and its branch — the base of this PR — was deleted, and a closed PR cannot be reopened or retargeted once its base is gone. #1109 carries the same two commits rebased onto development.