feat(security): harden the API and lock synchronizations across instances

- Validate the environment at startup (src/config): required variables
  must be present, HIBOUTIK_BASE_URL must be HTTPS.
- Global ValidationPipe (whitelist, forbidNonWhitelisted, transform).
- Helmet, CORS disabled unless CORS_ORIGINS is set, TRUST_PROXY support,
  HTTP header/request timeouts, shutdown hooks.
- Rate limiting: 60 req/min/IP globally, 5 req/min on POST /sync.
- AllExceptionsFilter: unexpected errors are logged (message + stack,
  never the raw error object) and answered with a generic 500.
- Postgres advisory lock (dedicated connection) so only one
  synchronization runs at a time across all instances; released by
  Postgres itself if the process dies.
- Fix the Jest moduleNameMapper (unescaped dot also matched .cjs files).
- Document the input validation and security rules in CLAUDE.md.
- Add class-validator, class-transformer, helmet and @nestjs/throttler;
  npm audit fix refreshed package-lock.json.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

test/app.e2e-spec.ts

@@ -27,12 +27,12 @@ describe('AppController (e2e)', () => {
   });
 
   it('POST /sync starts a synchronization (202)', () => {
-    hiboutikService.startSync.mockReturnValue(true);
+    hiboutikService.startSync.mockResolvedValue(true);
     return request(app.getHttpServer()).post('/sync').expect(202).expect({ message: 'Hiboutik synchronization started' });
   });
 
   it('POST /sync answers 409 when a synchronization is already running', () => {
-    hiboutikService.startSync.mockReturnValue(false);
+    hiboutikService.startSync.mockResolvedValue(false);
     return request(app.getHttpServer()).post('/sync').expect(409);
   });
 

test/jest-e2e.json

@@ -3,6 +3,7 @@
   "rootDir": ".",
   "testEnvironment": "node",
   "testRegex": ".e2e-spec.ts$",
+  "setupFiles": ["<rootDir>/setup-env.ts"],
   "transform": {
     "^.+.ts$": "ts-jest",
     "^.+.js$": [
@@ -18,6 +19,6 @@
   },
   "transformIgnorePatterns": ["/node_modules/(?!@nestjs/config/)"],
   "moduleNameMapper": {
-    "^(.{1,2}/.*).js$": "$1"
+    "^(\\.{1,2}/.*)\\.js$": "$1"
   }
 }

test/setup-env.ts

@@ -0,0 +1,5 @@
+// The e2e test needs neither a database nor Hiboutik, but the app validates its environment at startup: provide dummy values.
+process.env.DATABASE_URL ??= 'postgresql://test:test@localhost:5432/test';
+process.env.HIBOUTIK_BASE_URL ??= 'https://example.hiboutik.test/api';
+process.env.HIBOUTIK_USERNAME ??= 'test';
+process.env.HIBOUTIK_PASSWORD ??= 'test';