feat: API key rotation, input sanitization, DB pooling config, CORS env docs

[hardcordev]

Summary

Adds a zero-downtime API key rotation mechanism with a grace period, global input sanitization for user-provided strings, explicit Prisma connection pool configuration for production, and full CORS configuration documentation with env-var configurability.

Changes

• API key rotation ([Enhancement] No API key rotation mechanism #379): OperatorAuthGuard now accepts rotated-out keys via ORACLE_OPERATOR_API_KEY_PREVIOUS / ADMIN_API_KEY_PREVIOUS during a configurable grace window (API_KEY_ROTATION_GRACE_MINUTES, default 24h measured from process start), so compromised keys can be replaced without downtime or manual intervention.
• Input sanitization ([Enhancement] No input sanitization on user-provided strings #380): new InputSanitizationMiddleware (src/common/middleware/input-sanitization.middleware.ts), registered globally on the Express adapter in main.ts right after the body parsers, trims and escapes angle brackets in every string of JSON/urlencoded request bodies before validation/persistence.
• Connection pooling ([Enhancement] No database connection pooling configuration #381): PrismaService applies explicit pool parameters to the datasource URL at runtime (connection_limit=10, pool_timeout=10, connect_timeout=5), overridable via DATABASE_CONNECTION_LIMIT, DATABASE_POOL_TIMEOUT, DATABASE_CONNECT_TIMEOUT, or params already present in DATABASE_URL.
• CORS ([Enhancement] No CORS configuration documentation #382): methods, allowed headers, and credentials are now configurable via CORS_METHODS, CORS_ALLOWED_HEADERS, and CORS_CREDENTIALS (defaults unchanged from the previously hardcoded values); documented in code, .env.example, and a new README "CORS configuration" section.

Issues

Resolves #379
Resolves #380
Resolves #381
Resolves #382

Verification

Manual code review only: full diff inspected against all four issues; existing architecture, naming, and conventions kept; no unrelated changes, snapshots, or generated files touched. cargo build and cargo test were not run (not applicable — TypeScript repo); npm build/jest were also not run per job policy.

[drips-wave]

@hardcordev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits