fix(#377): remediate code review and security findings

- Fix sendThreadMessage room mismatch: use channelId from options instead of hardcoded controlRoomId
- Add .catch() to fire-and-forget handleRoomMessage to prevent silent error swallowing
- Wrap dispatchJob in try-catch for user-visible error reporting in handleFixCommand
- Add MATRIX_BOT_USER_ID validation in connect() to prevent infinite message loops
- Fix streamResponse error masking: wrap finally/catch side-effects in try-catch
- Replace unsafe type assertion with public getClient() in MatrixRoomService
- Add orphaned room warning in provisionRoom on DB failure
- Add provider identity to Herald error logs
- Add channelId to ThreadMessageOptions interface and all callers
- Add missing env var warnings in BridgeModule factory
- Fix JSON injection in setup-bot.sh: use jq for safe JSON construction

Fixes #377

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/bridge/matrix/matrix-room.service.spec.ts

@@ -24,12 +24,13 @@ describe("MatrixRoomService", () => {
 
   const mockCreateRoom = vi.fn().mockResolvedValue("!new-room:example.com");
 
+  const mockMatrixClient = {
+    createRoom: mockCreateRoom,
+  };
+
   const mockMatrixService = {
     isConnected: vi.fn().mockReturnValue(true),
-    // Private field accessed by MatrixRoomService.getMatrixClient()
-    client: {
-      createRoom: mockCreateRoom,
-    },
+    getClient: vi.fn().mockReturnValue(mockMatrixClient),
   };
 
   const mockPrismaService = {