fix: security headers (Helmet), Soroban fee from simulation, cache stampede, forced shutdown timeout

[codemagician1949]

Summary

• No security headers (Helmet) -- missing OWASP protections #220 — Security headers (Helmet/OWASP): Registered @fastify/helmet with a restrictive OWASP-aligned configuration: CSP with default-src 'none', HSTS 1 year + includeSubDomains + preload, X-Frame-Options: DENY, noSniff, xssFilter, hidePoweredBy. Added @fastify/helmet ^13.0.1 to package.json dependencies.

• Fee not computed from Soroban simulation -- transactions may fail on-chain #218 — Fee from Soroban simulation: invokeContract was building transactions with the hardcoded BASE_FEE (100 stroops), causing on-chain failures when Soroban resource fees exceeded that amount. Now: (1) simulate with a throw-away transaction; (2) extract minResourceFee from the success response; (3) compute totalFee = BASE_FEE + minResourceFee × 1.2 (20 % buffer for fee-market fluctuations); (4) rebuild the transaction with the computed fee before calling assembleTransaction.

• Cache stampede (thundering herd) -- no protection on cache miss #217 — Cache stampede / thundering herd: Added cacheGetOrSet<T>() to src/cache/index.ts. On a cache miss, exactly one concurrent caller executes fetchFn and populates the cache; all other callers for the same key await the same in-flight Promise stored in an in-process Map. The promise is removed from the map in a finally block so a failed fetch doesn't permanently block future requests.

• No forced shutdown timeout -- process hangs if DB/Redis stuck #216 — Forced shutdown timeout: The shutdown handler now starts a 10 s setTimeout (with .unref() so it doesn't keep the event loop alive on its own) that calls process.exit(1) if graceful shutdown has not completed. clearTimeout is called if shutdown finishes normally so production restarts remain clean.

Test plan

• curl -I /health — response includes Strict-Transport-Security, X-Content-Type-Options: nosniff, Content-Security-Policy, X-Frame-Options: DENY
• Inspect invokeContract logs — fee logged should be BASE_FEE + minResourceFee×1.2, not 100
• Simulate 50 concurrent requests to a cached endpoint with an empty cache — DB/service should be called exactly once per key
• kill -SIGTERM <pid> while DB is unreachable — process exits within 10 s with code 1 instead of hanging

Closes #220
Closes #218
Closes #217
Closes #216

[drips-wave]

@codemagician1949 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits