feat(security): harden the API, trust Hiboutik for deletions, lock syncs (#3)

src/services/hiboutik/brand.hiboutik.service.ts

@@ -25,11 +25,7 @@ export class BrandHiboutikService {
       (brand) => `Hiboutik brand ${brand.hiboutikId}`,
     );
 
-    // Safety net: an empty answer from Hiboutik most likely means an API issue
-    if (hiboutikBrands.length === 0) {
-      this.logger.warn('Hiboutik returned no brands: deletion skipped.');
-      return;
-    }
+    // Hiboutik is trusted: a successful (2xx) answer, even an empty list, is the truth. An HTTP error throws before this point.
     const nbDeleted = await this.brandDatabaseRepository.deleteMissing(hiboutikBrands.map((dto) => Number(dto.brand_id)));
     this.logger.log(
       `Brands sync ended: ${hiboutikBrands.length - nbFailed}/${hiboutikBrands.length} synced, ${nbFailed} failed, ${nbDeleted} deleted.`,