feat(security): harden the API, trust Hiboutik for deletions, lock syncs (#3)

- Sync deletions: a 2xx Hiboutik answer is the truth, even an empty list; a failed call (HTTP error or non-list body) deletes nothing (HiboutikClient.getList).
- Validate the environment at startup (HIBOUTIK_BASE_URL must be HTTPS), global ValidationPipe, Helmet, CORS opt-in, HTTP timeouts, rate limiting (60 req/min/IP, 5 on POST /sync), AllExceptionsFilter.
- Postgres advisory lock so only one synchronization runs at a time across instances; syncAll is private, syncs start through startSync.
- Fix the Jest moduleNameMapper; document the validation and security rules in CLAUDE.md.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/services/hiboutik/customer.hiboutik.service.spec.ts

@@ -48,9 +48,17 @@ describe('CustomerHiboutikService', () => {
     expect(customerDatabaseRepository.upsert).toHaveBeenCalledTimes(2);
   });
 
-  it('does not delete customers when Hiboutik returns none', async () => {
+  it('deletes every customer when Hiboutik answers with an empty list', async () => {
     await service.syncCustomers();
 
+    expect(customerDatabaseRepository.deleteMissing).toHaveBeenCalledWith([]);
+  });
+
+  it('deletes nothing when the Hiboutik call fails', async () => {
+    customerHiboutikRepository.getCustomers.mockRejectedValue(new Error('Request failed with status code 500'));
+
+    await expect(service.syncCustomers()).rejects.toThrow('500');
+
     expect(customerDatabaseRepository.deleteMissing).not.toHaveBeenCalled();
   });