fix(api): throttle before auth, configurable proxy trust, no-store and a strict CSP

- ThrottlerGuard runs first, so requests with wrong tokens or API keys
  count against the rate limit before any database lookup.
- TRUST_PROXY (hop count or Express list) replaces the hard-coded 1.
- Every API answer except the public lot pages is Cache-Control: no-store
  without ETag; helmet sends default-src 'none' / frame-ancestors 'none'
  (Swagger keeps the page policy when enabled) and same-site CORP.
- Request log lines carry the path only - no query strings (the SSO
  callback's code and state no longer reach the logs).
- In production the server refuses to start without an https
  FRONTEND_ORIGIN or with COOKIE_SECURE=false.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/test/security-headers.e2e-spec.ts

@@ -0,0 +1,44 @@
+import { INestApplication } from '@nestjs/common';
+import request from 'supertest';
+import { App } from 'supertest/types';
+import { createTestApp } from './utils/create-test-app';
+
+describe('Security headers (e2e)', () => {
+  let app: INestApplication<App>;
+
+  beforeAll(async () => {
+    app = await createTestApp();
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('marks API answers no-store, unframeable and without an ETag', async () => {
+    const response = await request(app.getHttpServer())
+      .get('/api/v1/auth/sso/status')
+      .expect(200);
+
+    expect(response.headers['cache-control']).toBe('no-store');
+    expect(response.headers['content-security-policy']).toContain(
+      "default-src 'none'",
+    );
+    expect(response.headers['content-security-policy']).toContain(
+      "frame-ancestors 'none'",
+    );
+    expect(response.headers['etag']).toBeUndefined();
+    expect(response.headers['x-powered-by']).toBeUndefined();
+  });
+
+  it('rate-limits requests with a wrong API key like any other', async () => {
+    const server = app.getHttpServer();
+    const statuses: number[] = [];
+    for (let i = 0; i < 105 && !statuses.includes(429); i++) {
+      const response = await request(server)
+        .get('/api/v1/shop-sync')
+        .set('Authorization', `Bearer ack_aaaaaaaa_${'A'.repeat(43)}`);
+      statuses.push(response.status);
+    }
+    expect(statuses).toContain(429);
+  });
+});