feat(security): harden the API, trust Hiboutik for deletions, lock syncs (#3)

- Sync deletions: a 2xx Hiboutik answer is the truth, even an empty list; a failed call (HTTP error or non-list body) deletes nothing (HiboutikClient.getList).
- Validate the environment at startup (HIBOUTIK_BASE_URL must be HTTPS), global ValidationPipe, Helmet, CORS opt-in, HTTP timeouts, rate limiting (60 req/min/IP, 5 on POST /sync), AllExceptionsFilter.
- Postgres advisory lock so only one synchronization runs at a time across instances; syncAll is private, syncs start through startSync.
- Fix the Jest moduleNameMapper; document the validation and security rules in CLAUDE.md.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/app.module.ts

@@ -1,6 +1,10 @@
 import { Module } from '@nestjs/common';
+import { APP_FILTER, APP_GUARD } from '@nestjs/core';
+import { AllExceptionsFilter } from './filters/all-exceptions.filter';
+import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
 import { AppController } from './app.controller';
 import { ConfigModule } from '@nestjs/config';
+import { validateEnv } from './config/env.validation';
 import { HiboutikService } from './services/hiboutik/hiboutik.service';
 import { CategoryHiboutikRepository } from './hiboutik/category.hiboutik.repository';
 import { CategoryConverter } from './models/converter/category.converter';
@@ -32,17 +36,23 @@ import { CategoryHiboutikService } from './services/hiboutik/category.hiboutik.s
 import { CustomerHiboutikService } from './services/hiboutik/customer.hiboutik.service';
 import { SupplierHiboutikService } from './services/hiboutik/supplier.hiboutik.service';
 import { ProductHiboutikService } from './services/hiboutik/product.hiboutik.service';
+import { SyncLockDatabaseRepository } from './database/syncLock.database.repository';
 
 @Module({
   imports: [
     ConfigModule.forRoot({
       isGlobal: true,
+      validate: validateEnv,
     }),
+    // Default rate limit for every route: 60 requests per minute per IP (stricter limits via @Throttle)
+    ThrottlerModule.forRoot([{ ttl: 60_000, limit: 60 }]),
     HttpModule.register({ timeout: 30_000 }),
     PrismaModule,
   ],
   controllers: [AppController],
   providers: [
+    { provide: APP_GUARD, useClass: ThrottlerGuard },
+    { provide: APP_FILTER, useClass: AllExceptionsFilter },
     BrandConverter,
     BrandDatabaseRepository,
     BrandHiboutikRepository,
@@ -70,6 +80,7 @@ import { ProductHiboutikService } from './services/hiboutik/product.hiboutik.ser
     StockHiboutikRepository,
     SupplierConverter,
     SupplierDatabaseRepository,
+    SyncLockDatabaseRepository,
     SupplierHiboutikRepository,
     SupplierHiboutikService,
   ],