- Sync deletions: a 2xx Hiboutik answer is the truth, even an empty list; a failed call (HTTP error or non-list body) deletes nothing (HiboutikClient.getList).
- Validate the environment at startup (HIBOUTIK_BASE_URL must be HTTPS), global ValidationPipe, Helmet, CORS opt-in, HTTP timeouts, rate limiting (60 req/min/IP, 5 on POST /sync), AllExceptionsFilter.
- Postgres advisory lock so only one synchronization runs at a time across instances; syncAll is private, syncs start through startSync.
- Fix the Jest moduleNameMapper; document the validation and security rules in CLAUDE.md.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
## Summary
- Add `CLAUDE.md`: project description (K-pop shop backend, buffer in front of Hiboutik), architecture, domain notes, git workflow.
- Add shared `.claude/settings.json` (allowed dev commands, `.env` read protection).
- Pin the Prisma agent skills in `skills-lock.json` (restore with `npx skills experimental_install`, documented in the README).
- Update `.gitignore` (generated skills, local settings, Postman skills) and add `.gitattributes` (LF line endings).
## Note
This branch is based on `feat/customer-addresses-orders`, so the PR also contains the 3 feature commits (addresses, company details, orders) that `CLAUDE.md` describes.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: MastersGame <quentin.duwa1210@gmail.com>
Reviewed-on: #2
