fix(api): throttle before auth, configurable proxy trust, no-store and a strict CSP

- ThrottlerGuard runs first, so requests with wrong tokens or API keys
  count against the rate limit before any database lookup.
- TRUST_PROXY (hop count or Express list) replaces the hard-coded 1.
- Every API answer except the public lot pages is Cache-Control: no-store
  without ETag; helmet sends default-src 'none' / frame-ancestors 'none'
  (Swagger keeps the page policy when enabled) and same-site CORP.
- Request log lines carry the path only - no query strings (the SSO
  callback's code and state no longer reach the logs).
- In production the server refuses to start without an https
  FRONTEND_ORIGIN or with COOKIE_SECURE=false.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/main.ts

@@ -15,6 +15,21 @@ const REQUIRED_ENV_VARS = ['DATABASE_URL', 'JWT_ACCESS_SECRET'] as const;
 // generate one.
 const MIN_JWT_SECRET_LENGTH = 32;
 
+function assertProductionSettings(): void {
+  if (process.env.NODE_ENV !== 'production') {
+    return;
+  }
+  // Without it CORS and SSO redirects silently fall back to localhost.
+  if (!process.env.FRONTEND_ORIGIN?.startsWith('https://')) {
+    throw new Error(
+      'FRONTEND_ORIGIN must be set to an https:// origin in production',
+    );
+  }
+  if (process.env.COOKIE_SECURE === 'false') {
+    throw new Error('COOKIE_SECURE=false is for local HTTP development only');
+  }
+}
+
 function assertRequiredEnvVars(): void {
   const missing = REQUIRED_ENV_VARS.filter((name) => !process.env[name]);
   if (missing.length > 0) {
@@ -32,6 +47,7 @@ function assertRequiredEnvVars(): void {
 
 async function bootstrap() {
   assertRequiredEnvVars();
+  assertProductionSettings();
 
   const app = await NestFactory.create<NestExpressApplication>(AppModule);
   app.enableShutdownHooks();