Error logging verbosity in UserContactMappingService

Problem/Motivation

A security review identified a low severity issue in exception handling. In src/Service/UserContactMappingService.php, exception messages from EntityStorageException are logged directly via $e->getMessage(). These messages may contain database details, file paths, or other system internals. Logging them directly could expose sensitive information in log files. The exceptions are also re-thrown, so callers may surface these messages to end users if not caught properly.

Affected locations:

• src/Service/UserContactMappingService.php (lines 161-164): Contact creation failure
• src/Service/UserContactMappingService.php (lines 188-191): Mapping creation failure

Steps to reproduce

1. Trigger a contact creation or mapping creation failure (e.g., constraint violation, database error)
2. Check the Drupal log
3. Observe that the full exception message is recorded, which may include system details

Proposed resolution

• Log a generic message for the error context; keep detailed exception message only in logs when appropriate
• Use Drupal's placeholder sanitization for any user-facing error messages
• Ensure callers catch exceptions and show generic messages to end users, not raw exception text

Remaining tasks

• Review and update src/Service/UserContactMappingService.php exception logging
• Add inline comments documenting security considerations where applicable
• Manual testing of error scenarios
• Security review of changes
• Create merge request
• Code review

User interface changes

None. Error messages shown to users should remain generic.

API changes

None. This is an internal security hardening that doesn't change public APIs.

Data model changes

None.