Potential fix for code scanning alert no. 78: Information exposure through an exception

[Lexicoding-systems]

Potential fix for https://github.com/Lexicoding-systems/Lexecon/security/code-scanning/78

In general, the fix is to stop returning raw exception messages (or stack traces) to the client and instead return generic, non-sensitive messages while logging detailed errors on the server. The verification result should distinguish only between expected validation failures (like invalid signature) and unexpected internal errors, without exposing internal exception text.

The best minimal fix here is:

1. In SignatureService.verify_signature (src/lexecon/security/signature_service.py), keep the existing behavior for InvalidSignature (this is an expected user-facing error), but change the generic except Exception as e handler to:

   • Log the full exception server-side (using the standard logging module).
   • Return a generic message like "Internal verification error" that does not contain str(e).

2. In SignatureService, add a logging import and a module-level logger.

3. Optionally (but not strictly required for the specific CodeQL path), we could later adjust the FastAPI endpoint to further normalize user-facing messages, but once verify_packet_signature no longer embeds raw exception details, the current endpoint implementation is safe enough.

This preserves existing functionality in terms of boolean validity results and high-level error semantics: callers still receive False with a message when verification fails, but the message no longer leaks internal exception details for unexpected errors. The only code changes are within the shown snippet of signature_service.py; the API handler in server.py can remain as is because it will now only relay safe messages.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.