feat(security): harden the API, trust Hiboutik for deletions, lock syncs (#3)

- Sync deletions: a 2xx Hiboutik answer is the truth, even an empty list; a failed call (HTTP error or non-list body) deletes nothing (HiboutikClient.getList).
- Validate the environment at startup (HIBOUTIK_BASE_URL must be HTTPS), global ValidationPipe, Helmet, CORS opt-in, HTTP timeouts, rate limiting (60 req/min/IP, 5 on POST /sync), AllExceptionsFilter.
- Postgres advisory lock so only one synchronization runs at a time across instances; syncAll is private, syncs start through startSync.
- Fix the Jest moduleNameMapper; document the validation and security rules in CLAUDE.md.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

test/app.e2e-spec.ts

@@ -27,12 +27,12 @@ describe('AppController (e2e)', () => {
   });
 
   it('POST /sync starts a synchronization (202)', () => {
-    hiboutikService.startSync.mockReturnValue(true);
+    hiboutikService.startSync.mockResolvedValue(true);
     return request(app.getHttpServer()).post('/sync').expect(202).expect({ message: 'Hiboutik synchronization started' });
   });
 
   it('POST /sync answers 409 when a synchronization is already running', () => {
-    hiboutikService.startSync.mockReturnValue(false);
+    hiboutikService.startSync.mockResolvedValue(false);
     return request(app.getHttpServer()).post('/sync').expect(409);
   });
 

test/jest-e2e.json

@@ -3,6 +3,7 @@
   "rootDir": ".",
   "testEnvironment": "node",
   "testRegex": ".e2e-spec.ts$",
+  "setupFiles": ["<rootDir>/setup-env.ts"],
   "transform": {
     "^.+.ts$": "ts-jest",
     "^.+.js$": [
@@ -18,6 +19,6 @@
   },
   "transformIgnorePatterns": ["/node_modules/(?!@nestjs/config/)"],
   "moduleNameMapper": {
-    "^(.{1,2}/.*).js$": "$1"
+    "^(\\.{1,2}/.*)\\.js$": "$1"
   }
 }

test/setup-env.ts

@@ -0,0 +1,5 @@
+// The e2e test needs neither a database nor Hiboutik, but the app validates its environment at startup: provide dummy values.
+process.env.DATABASE_URL ??= 'postgresql://test:test@localhost:5432/test';
+process.env.HIBOUTIK_BASE_URL ??= 'https://example.hiboutik.test/api';
+process.env.HIBOUTIK_USERNAME ??= 'test';
+process.env.HIBOUTIK_PASSWORD ??= 'test';