feat(security): harden the API, trust Hiboutik for deletions, lock syncs (#3)

- Sync deletions: a 2xx Hiboutik answer is the truth, even an empty list; a failed call (HTTP error or non-list body) deletes nothing (HiboutikClient.getList).
- Validate the environment at startup (HIBOUTIK_BASE_URL must be HTTPS), global ValidationPipe, Helmet, CORS opt-in, HTTP timeouts, rate limiting (60 req/min/IP, 5 on POST /sync), AllExceptionsFilter.
- Postgres advisory lock so only one synchronization runs at a time across instances; syncAll is private, syncs start through startSync.
- Fix the Jest moduleNameMapper; document the validation and security rules in CLAUDE.md.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/services/hiboutik/hiboutik.service.spec.ts

@@ -7,7 +7,10 @@ describe('HiboutikService', () => {
   const supplierService = { syncSuppliers: jest.fn() };
   const productService = { syncProducts: jest.fn() };
   const customerService = { syncCustomers: jest.fn() };
+  const syncLock = { tryAcquire: jest.fn() };
+  const release = jest.fn();
   let service: HiboutikService;
+  const flush = () => new Promise((resolve) => setImmediate(resolve));
 
   beforeAll(() => {
     jest.spyOn(Logger.prototype, 'log').mockImplementation(() => undefined);
@@ -22,12 +25,15 @@ describe('HiboutikService', () => {
     supplierService.syncSuppliers.mockResolvedValue(undefined);
     productService.syncProducts.mockResolvedValue(undefined);
     customerService.syncCustomers.mockResolvedValue(undefined);
+    release.mockResolvedValue(undefined);
+    syncLock.tryAcquire.mockResolvedValue(release);
     service = new HiboutikService(
       brandService as never,
       categoryService as never,
       customerService as never,
       productService as never,
       supplierService as never,
+      syncLock as never,
     );
   });
 
@@ -56,13 +62,44 @@ describe('HiboutikService', () => {
   it('refuses a second synchronization while one is running, and unlocks at the end', async () => {
     let finishBrands: () => void = () => undefined;
     brandService.syncBrands.mockReturnValue(new Promise<void>((resolve) => (finishBrands = resolve)));
+    // The lock is the only guard: the second request does not get it, even from the same instance
+    syncLock.tryAcquire.mockResolvedValueOnce(release).mockResolvedValueOnce(null);
 
-    expect(service.startSync()).toBe(true);
-    expect(service.isSyncInProgress).toBe(true);
-    expect(service.startSync()).toBe(false);
+    await expect(service.startSync()).resolves.toBe(true);
+    await expect(service.startSync()).resolves.toBe(false);
+    expect(brandService.syncBrands).toHaveBeenCalledTimes(1);
+    expect(release).not.toHaveBeenCalled();
 
     finishBrands();
-    await new Promise((resolve) => setImmediate(resolve));
-    expect(service.isSyncInProgress).toBe(false);
+    await flush();
+    expect(release).toHaveBeenCalledTimes(1);
+  });
+
+  it('starts nothing when another instance holds the lock', async () => {
+    syncLock.tryAcquire.mockResolvedValue(null);
+
+    await expect(service.startSync()).resolves.toBe(false);
+
+    expect(brandService.syncBrands).not.toHaveBeenCalled();
+    expect(release).not.toHaveBeenCalled();
+  });
+
+  it('starts nothing and can be retried when the lock cannot be requested', async () => {
+    syncLock.tryAcquire.mockRejectedValueOnce(new Error('database unreachable'));
+
+    await expect(service.startSync()).rejects.toThrow('database unreachable');
+    expect(brandService.syncBrands).not.toHaveBeenCalled();
+
+    await expect(service.startSync()).resolves.toBe(true);
+    await flush();
+  });
+
+  it('releases the lock even when the synchronization crashes', async () => {
+    jest.spyOn(service as never, 'syncAll').mockRejectedValue(new Error('crash'));
+
+    await expect(service.startSync()).resolves.toBe(true);
+    await flush();
+
+    expect(release).toHaveBeenCalledTimes(1);
   });
 });