feat(security): harden the API, trust Hiboutik for deletions, lock syncs (#3)

test/setup-env.ts

@@ -0,0 +1,5 @@
+// The e2e test needs neither a database nor Hiboutik, but the app validates its environment at startup: provide dummy values.
+process.env.DATABASE_URL ??= 'postgresql://test:test@localhost:5432/test';
+process.env.HIBOUTIK_BASE_URL ??= 'https://example.hiboutik.test/api';
+process.env.HIBOUTIK_USERNAME ??= 'test';
+process.env.HIBOUTIK_PASSWORD ??= 'test';