fix(phase-4): add DB error checking, mask sensitive auth tokens in API and middleware logs

internal/server/users.go

@@ -70,17 +70,33 @@ func (s *Server) handleUpdateUser(c *gin.Context) {
 	}
 
 	if req.DisplayName != nil {
-		s.database.Exec("UPDATE users SET display_name = ? WHERE id = ?", req.DisplayName, id)
+		if _, err := s.database.Exec("UPDATE users SET display_name = ? WHERE id = ?", req.DisplayName, id); err != nil {
+			c.JSON(http.StatusInternalServerError, ErrorResponse("Failed to update display name"))
+			return
+		}
 	}
 	if req.Role != nil {
-		s.database.Exec("UPDATE users SET role = ? WHERE id = ?", req.Role, id)
+		if _, err := s.database.Exec("UPDATE users SET role = ? WHERE id = ?", req.Role, id); err != nil {
+			c.JSON(http.StatusInternalServerError, ErrorResponse("Failed to update role"))
+			return
+		}
 	}
 	if req.MustChangePassword != nil {
-		s.database.Exec("UPDATE users SET must_change_password = ? WHERE id = ?", req.MustChangePassword, id)
+		if _, err := s.database.Exec("UPDATE users SET must_change_password = ? WHERE id = ?", req.MustChangePassword, id); err != nil {
+			c.JSON(http.StatusInternalServerError, ErrorResponse("Failed to update password flag"))
+			return
+		}
 	}
 	if req.Password != nil {
-		hash, _ := bcrypt.GenerateFromPassword([]byte(*req.Password), 12)
-		s.database.Exec("UPDATE users SET password_hash = ? WHERE id = ?", string(hash), id)
+		hash, err := bcrypt.GenerateFromPassword([]byte(*req.Password), 12)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, ErrorResponse("Failed to hash password"))
+			return
+		}
+		if _, err := s.database.Exec("UPDATE users SET password_hash = ? WHERE id = ?", string(hash), id); err != nil {
+			c.JSON(http.StatusInternalServerError, ErrorResponse("Failed to update password"))
+			return
+		}
 	}
 
 	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "User updated"}))