fix(api): throttle before auth, configurable proxy trust, no-store and a strict CSP

- ThrottlerGuard runs first, so requests with wrong tokens or API keys
  count against the rate limit before any database lookup.
- TRUST_PROXY (hop count or Express list) replaces the hard-coded 1.
- Every API answer except the public lot pages is Cache-Control: no-store
  without ETag; helmet sends default-src 'none' / frame-ancestors 'none'
  (Swagger keeps the page policy when enabled) and same-site CORP.
- Request log lines carry the path only - no query strings (the SSO
  callback's code and state no longer reach the logs).
- In production the server refuses to start without an https
  FRONTEND_ORIGIN or with COOKIE_SECURE=false.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/.env.example

@@ -14,6 +14,10 @@ SESSION_MAX_AGE="7d"
 
 PORT=3001
 FRONTEND_ORIGIN="http://localhost:3000"
+# Reverse-proxy hops in front of the backend whose X-Forwarded-For is
+# trusted (client IP for rate limits and API-key IP allowlists). "1" for the
+# single K8s ingress; a list such as "loopback, 10.0.0.0/8" also works.
+TRUST_PROXY=1
 
 # Refresh-token cookie requires HTTPS by default. Set to "false" only for
 # local HTTP development - every real deployment must leave this unset (or