Release v3.8.41 (#5327)

Release v3.8.41 — 52 commits since v3.8.40 (19 CHANGELOG bullets, 11 contributors).

All gating CI green: Unit×8, Coverage×8, Vitest, Package Artifact, Quality Ratchet, CodeQL, Lint, Docs Sync (Strict), Node 24/26 compat, E2E×9, Integration, Electron smoke.

Advisory checks overridden (main unprotected): PR Test Policy = test-masking heuristic on the cumulative 52-commit assert delta (legitimate dead-code-sweep removals + consolidations, reviewed per-PR); SonarCloud/SonarQube = new-code maintainability/coverage quality gate (CodeQL/Semgrep/Security/npm-audit/Dependabot all clean — not a security finding).

src/shared/http/apiErrorMessage.ts

@@ -0,0 +1,19 @@
+/**
+ * Extract a human-readable message from an API error response body.
+ *
+ * OmniRoute's structured error envelope is `{ error: { code, message,
+ * correlation_id } }`, but some routes return `{ error: "string" }`. Rendering
+ * the raw `error` object in the dashboard yields "[object Object]" (or nothing),
+ * which hid actionable messages such as `INVALID_ORIGIN` (#5340) — the operator
+ * saw a silent failure instead of guidance. Funnel API error bodies through this
+ * so the message (and its actionable hint) always surfaces.
+ */
+export function extractApiErrorMessage(body: unknown, fallback: string): string {
+  const err = (body as { error?: unknown } | null | undefined)?.error;
+  if (typeof err === "string" && err.trim()) return err.trim();
+  if (err && typeof err === "object") {
+    const message = (err as { message?: unknown }).message;
+    if (typeof message === "string" && message.trim()) return message.trim();
+  }
+  return fallback;
+}