fix(#377): remediate code review and security findings

- Fix sendThreadMessage room mismatch: use channelId from options instead of hardcoded controlRoomId
- Add .catch() to fire-and-forget handleRoomMessage to prevent silent error swallowing
- Wrap dispatchJob in try-catch for user-visible error reporting in handleFixCommand
- Add MATRIX_BOT_USER_ID validation in connect() to prevent infinite message loops
- Fix streamResponse error masking: wrap finally/catch side-effects in try-catch
- Replace unsafe type assertion with public getClient() in MatrixRoomService
- Add orphaned room warning in provisionRoom on DB failure
- Add provider identity to Herald error logs
- Add channelId to ThreadMessageOptions interface and all callers
- Add missing env var warnings in BridgeModule factory
- Fix JSON injection in setup-bot.sh: use jq for safe JSON construction

Fixes #377

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/bridge/matrix/matrix-streaming.service.ts

@@ -195,14 +195,26 @@ export class MatrixStreamingService {
       this.logger.error(`Stream error in room ${roomId}: ${errorMessage}`);
 
       // Edit message to show error
-      const errorContent = accumulatedText
-        ? `${accumulatedText}\n\n[Streaming error: ${errorMessage}]`
-        : `[Streaming error: ${errorMessage}]`;
+      try {
+        const errorContent = accumulatedText
+          ? `${accumulatedText}\n\n[Streaming error: ${errorMessage}]`
+          : `[Streaming error: ${errorMessage}]`;
 
-      await this.editMessage(roomId, eventId, errorContent);
+        await this.editMessage(roomId, eventId, errorContent);
+      } catch (editError: unknown) {
+        this.logger.warn(
+          `Failed to edit error message in ${roomId}: ${editError instanceof Error ? editError.message : "unknown"}`
+        );
+      }
     } finally {
       // Step 4: Clear typing indicator
-      await this.setTypingIndicator(roomId, false);
+      try {
+        await this.setTypingIndicator(roomId, false);
+      } catch (typingError: unknown) {
+        this.logger.warn(
+          `Failed to clear typing indicator in ${roomId}: ${typingError instanceof Error ? typingError.message : "unknown"}`
+        );
+      }
     }
 
     // Step 5: Final edit with clean output (if no error)