fix(SEC-API-28): Replace MCP console.error with NestJS Logger

Replace all console.error calls in MCP services with NestJS Logger
instances for consistent structured logging in production.

- mcp-hub.service.ts: Add Logger instance, replace console.error in
  onModuleDestroy cleanup
- stdio-transport.ts: Add Logger instance, replace console.error for
  stderr output (as warn) and JSON parse failures (as error)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/mcp/mcp-hub.service.ts

@@ -1,4 +1,4 @@
-import { Injectable, OnModuleDestroy } from "@nestjs/common";
+import { Injectable, Logger, OnModuleDestroy } from "@nestjs/common";
 import { StdioTransport } from "./stdio-transport";
 import { ToolRegistryService } from "./tool-registry.service";
 import type { McpServer, McpServerConfig, McpRequest, McpResponse } from "./interfaces";
@@ -16,6 +16,7 @@ interface McpServerWithTransport extends McpServer {
  */
 @Injectable()
 export class McpHubService implements OnModuleDestroy {
+  private readonly logger = new Logger(McpHubService.name);
   private servers = new Map<string, McpServerWithTransport>();
 
   constructor(private readonly toolRegistry: ToolRegistryService) {}
@@ -161,7 +162,7 @@ export class McpHubService implements OnModuleDestroy {
   async onModuleDestroy(): Promise<void> {
     const stopPromises = Array.from(this.servers.keys()).map((serverId) =>
       this.stopServer(serverId).catch((error: unknown) => {
-        console.error(`Failed to stop server ${serverId}:`, error);
+        this.logger.error(`Failed to stop server ${serverId}:`, error);
       })
     );
 

apps/api/src/mcp/stdio-transport.ts

@@ -1,4 +1,5 @@
 import { spawn, type ChildProcess } from "node:child_process";
+import { Logger } from "@nestjs/common";
 import type { McpRequest, McpResponse } from "./interfaces";
 
 /**
@@ -6,6 +7,7 @@ import type { McpRequest, McpResponse } from "./interfaces";
  * Spawns a child process and communicates via stdin/stdout using JSON-RPC 2.0
  */
 export class StdioTransport {
+  private readonly logger = new Logger(StdioTransport.name);
   private process?: ChildProcess;
   private pendingRequests = new Map<
     string | number,
@@ -39,7 +41,7 @@ export class StdioTransport {
         });
 
         this.process.stderr?.on("data", (data: Buffer) => {
-          console.error(`MCP stderr: ${data.toString()}`);
+          this.logger.warn(`MCP stderr: ${data.toString()}`);
         });
 
         this.process.on("error", (error) => {
@@ -130,7 +132,7 @@ export class StdioTransport {
           const response = JSON.parse(message) as McpResponse;
           this.handleResponse(response);
         } catch (error) {
-          console.error("Failed to parse MCP response:", error);
+          this.logger.error("Failed to parse MCP response:", error);
         }
       }
     }