feat(security): harden the API, trust Hiboutik for deletions, lock syncs (#3)

- Sync deletions: a 2xx Hiboutik answer is the truth, even an empty list; a failed call (HTTP error or non-list body) deletes nothing (HiboutikClient.getList).
- Validate the environment at startup (HIBOUTIK_BASE_URL must be HTTPS), global ValidationPipe, Helmet, CORS opt-in, HTTP timeouts, rate limiting (60 req/min/IP, 5 on POST /sync), AllExceptionsFilter.
- Postgres advisory lock so only one synchronization runs at a time across instances; syncAll is private, syncs start through startSync.
- Fix the Jest moduleNameMapper; document the validation and security rules in CLAUDE.md.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/hiboutik/hiboutik.client.ts

@@ -33,6 +33,17 @@ export class HiboutikClient {
     return response.data;
   }
 
+  /**
+   * GET on a list endpoint. HTTP errors (4xx/5xx) throw, a 2xx answer without body is an empty list, and any other
+   * non-list body throws: an empty list triggers deletions in the sync, so it must never be inferred from a malformed answer.
+   */
+  async getList<T>(path: string, params?: Record<string, unknown>): Promise<T[]> {
+    const data = await this.get<T[] | '' | null | undefined>(path, params);
+    if (data === '' || data == null) return [];
+    if (!Array.isArray(data)) throw new Error(`Unexpected answer from Hiboutik ${path}: a list was expected`);
+    return data;
+  }
+
   /**
    * Fetches every page of a paginated endpoint (`p` param, starting at 1) and concatenates the results.
    * Only for paginated endpoints: on a non-paginated one, a full first page would loop forever on the same results.
@@ -42,8 +53,8 @@ export class HiboutikClient {
     let page = 1;
 
     while (true) {
-      const pageData = await this.get<T[]>(path, { ...baseParams, p: page });
-      if (!pageData || pageData.length === 0) break;
+      const pageData = await this.getList<T>(path, { ...baseParams, p: page });
+      if (pageData.length === 0) break;
       results.push(...pageData);
       // A page smaller than the page size is the last one: no need to request an empty page
       if (pageData.length < HIBOUTIK_PAGE_SIZE) break;