[Code Quality] Winston logger dependency declared but never used; simple console wrapper used instead

[coderabbitai]

Summary

winston is listed as a production dependency in package.json but is never imported anywhere in the codebase. src/cli/commands/export.ts defines a minimal console.* wrapper called logger instead.

Impact

• Dead dependency increases install size (~0.5 MB)
• Inconsistent logging: no log levels, no log file output, no structured logging, no rotation
• Users have no way to enable verbose/debug mode

Recommended Fix

Either:

1. Replace the inline logger with a properly configured winston instance (with configurable transports and log levels via --verbose flag)
2. Remove winston from package.json and standardise on a lighter logger (e.g., pino)

Backlink: #1