fix: Address PR review feedback for shared packages

This commit addresses all "Should Fix" items from the PR review:

1. Security Documentation (platform package)
   - Added comprehensive inline documentation in security.ts explaining
     why path validation is disabled
   - Added Security Model section to platform README.md
   - Documented rationale, implications, and future re-enabling steps

2. Model Resolver Tests
   - Created comprehensive test suite (34 tests, 100% coverage)
   - Added vitest configuration with strict coverage thresholds
   - Tests cover: alias resolution, full model strings, priority handling,
     edge cases, and integration scenarios
   - Updated package.json with test scripts and vitest dependency

3. Feature Loader Logging Migration
   - Replaced all console.log/warn/error calls with @automaker/utils logger
   - Consistent with rest of codebase logging pattern
   - Updated corresponding tests to match new logger format

4. Module Format Consistency
   - Verified all packages use consistent module formats (ESM)
   - No changes needed

All tests passing (632 tests across 31 test files).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

apps/server/tests/unit/services/feature-loader.test.ts

@@ -144,6 +144,7 @@ describe("feature-loader.ts", () => {
       expect(result).toHaveLength(1);
       expect(result[0].id).toBe("feature-2");
       expect(consoleSpy).toHaveBeenCalledWith(
+        "[FeatureLoader]",
         expect.stringContaining("missing required 'id' field")
       );
 
@@ -189,7 +190,10 @@ describe("feature-loader.ts", () => {
       const result = await loader.getAll(testProjectPath);
 
       expect(result).toEqual([]);
-      expect(consoleSpy).toHaveBeenCalled();
+      expect(consoleSpy).toHaveBeenCalledWith(
+        "[FeatureLoader]",
+        expect.stringContaining("Failed to parse feature.json")
+      );
 
       consoleSpy.mockRestore();
     });
@@ -362,6 +366,11 @@ describe("feature-loader.ts", () => {
       const result = await loader.delete(testProjectPath, "feature-123");
 
       expect(result).toBe(false);
+      expect(consoleSpy).toHaveBeenCalledWith(
+        "[FeatureLoader]",
+        expect.stringContaining("Failed to delete feature"),
+        expect.objectContaining({ message: "Permission denied" })
+      );
       consoleSpy.mockRestore();
     });
   });