feat(security): add security hardening — Helmet, CORS, rate limiting, input sanitization

- Add Helmet with CSP, HSTS, referrer policy
- Configure CORS with environment-based origins
- Add global validation pipe with whitelist mode
- Add SanitizeInputMiddleware for XSS prevention
- Add ThrottlerBehindProxyGuard for rate limiting
- Add FileValidationPipe for upload security
- Set request body size limit to 1MB

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/modules/shared/shared.module.ts

@@ -6,6 +6,7 @@ import { GlobalExceptionFilter } from './infrastructure/filters/global-exception
 import { LoggerService } from './infrastructure/logger.service';
 import { CorrelationIdMiddleware } from './infrastructure/middleware/correlation-id.middleware';
 import { RequestLoggingMiddleware } from './infrastructure/middleware/request-logging.middleware';
+import { SanitizeInputMiddleware } from './infrastructure/middleware/sanitize-input.middleware';
 import { PrismaService } from './infrastructure/prisma.service';
 import { RedisService } from './infrastructure/redis.service';
 
@@ -26,6 +27,8 @@ import { RedisService } from './infrastructure/redis.service';
 })
 export class SharedModule implements NestModule {
   configure(consumer: MiddlewareConsumer): void {
-    consumer.apply(CorrelationIdMiddleware, RequestLoggingMiddleware).forRoutes('*');
+    consumer
+      .apply(CorrelationIdMiddleware, SanitizeInputMiddleware, RequestLoggingMiddleware)
+      .forRoutes('*');
   }
 }