feat(security): harden the API, trust Hiboutik for deletions, lock syncs (#3)

- Sync deletions: a 2xx Hiboutik answer is the truth, even an empty list; a failed call (HTTP error or non-list body) deletes nothing (HiboutikClient.getList).
- Validate the environment at startup (HIBOUTIK_BASE_URL must be HTTPS), global ValidationPipe, Helmet, CORS opt-in, HTTP timeouts, rate limiting (60 req/min/IP, 5 on POST /sync), AllExceptionsFilter.
- Postgres advisory lock so only one synchronization runs at a time across instances; syncAll is private, syncs start through startSync.
- Fix the Jest moduleNameMapper; document the validation and security rules in CLAUDE.md.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

package.json

@@ -26,9 +26,13 @@
     "@nestjs/config": "^12.0.0",
     "@nestjs/core": "^11.0.1",
     "@nestjs/platform-express": "^11.0.1",
+    "@nestjs/throttler": "^6.7.1",
     "@prisma/adapter-pg": "^7.10.0",
     "@prisma/client": "^7.10.0",
     "axios": "1.20.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
+    "helmet": "^8.3.0",
     "pg": "^8.23.0",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.1"
@@ -90,7 +94,7 @@
       "/node_modules/(?!@nestjs/config/)"
     ],
     "moduleNameMapper": {
-      "^(.{1,2}/.*).js$": "$1"
+      "^(\\.{1,2}/.*)\\.js$": "$1"
     }
   },
   "allowScripts": {