fix(#377): remediate code review and security findings

- Fix sendThreadMessage room mismatch: use channelId from options instead of hardcoded controlRoomId
- Add .catch() to fire-and-forget handleRoomMessage to prevent silent error swallowing
- Wrap dispatchJob in try-catch for user-visible error reporting in handleFixCommand
- Add MATRIX_BOT_USER_ID validation in connect() to prevent infinite message loops
- Fix streamResponse error masking: wrap finally/catch side-effects in try-catch
- Replace unsafe type assertion with public getClient() in MatrixRoomService
- Add orphaned room warning in provisionRoom on DB failure
- Add provider identity to Herald error logs
- Add channelId to ThreadMessageOptions interface and all callers
- Add missing env var warnings in BridgeModule factory
- Fix JSON injection in setup-bot.sh: use jq for safe JSON construction

Fixes #377

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/herald/herald.service.ts

@@ -77,6 +77,7 @@ export class HeraldService {
     const firstEventPayload = firstEvent?.payload as Record<string, unknown> | undefined;
     const metadata = firstEventPayload?.metadata as Record<string, unknown> | undefined;
     const threadId = metadata?.threadId as string | undefined;
+    const channelId = metadata?.channelId as string | undefined;
 
     if (!threadId) {
       this.logger.debug(`Job ${jobId} has no threadId, skipping broadcast`);
@@ -95,13 +96,15 @@ export class HeraldService {
       try {
         await provider.sendThreadMessage({
           threadId,
+          channelId: channelId ?? "",
           content: message,
         });
-      } catch (error) {
+      } catch (error: unknown) {
         // Log and continue — one provider failure must not block others
+        const providerName = provider.constructor.name;
         this.logger.error(
-          `Failed to broadcast event ${event.type} for job ${jobId} via provider:`,
-          error
+          `Failed to broadcast event ${event.type} for job ${jobId} via ${providerName}:`,
+          error instanceof Error ? error.message : error
         );
       }
     }