security(hardening): add helmet and standard secure headers in main.ts

[phertyameen]

Summary

backend/src/main.ts sets up validation, correlation IDs, exception filters, Swagger, CORS, and graceful shutdown - but no helmet() (or equivalent header middleware). The API therefore serves responses without X-Content-Type-Options, Strict-Transport-Security, X-Frame-Options, etc. For an API holding auth tokens and user metadata (a geolocation middleware already enriches requests), these are low-cost wins.

Proposal

1. Add the helmet dependency and app.use(helmet()) early in bootstrap; verify Swagger UI at /api still renders afterwards.
2. Gate HSTS behind NODE_ENV=production using the existing config namespace pattern (app.config.ts).
3. Set crossOriginResourcePolicy compatible with the frontend origin allowlist from the CORS work.

Acceptance criteria

• Secure headers present on all responses in production mode.
• Swagger UI at /api still loads locally.
• Change covered by a smoke assertion (e.g. e2e test asserting X-Content-Type-Options: nosniff).