fix: prevent UTF-8 panic in error message truncation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/services/synthesis.rs

@@ -1310,7 +1310,8 @@ fn sanitize_error_message(msg: &str) -> String {
 
     // For other errors, truncate and sanitize
     if msg.len() > 200 {
-        format!("{}...", &msg[..200])
+        let truncated: String = msg.chars().take(200).collect();
+        format!("{}...", truncated)
     } else {
         msg.to_string()
     }
@@ -1683,4 +1684,11 @@ mod tests {
         let result = rotate_sources(sources.clone(), Some("https://notfound.com"));
         assert_eq!(result[0].url, "https://a.com");
     }
+
+    #[test]
+    fn sanitize_error_message_handles_multibyte_utf8() {
+        let msg = "é".repeat(150); // 300 bytes, 150 chars
+        let result = sanitize_error_message(&msg);
+        assert!(result.ends_with("..."));
+    }
 }