[BE-128] Add HTTP security headers (helmet)

[mftee]

Overview

backend/src/main.ts configures CORS, a validation pipe, an exception filter, and Swagger — but sets no security headers. helmet is not among the dependencies, so responses ship without HSTS, X-Content-Type-Options, frame protection, or referrer policy.

Tasks

• Add helmet and apply it in main.ts before other middleware.
• Enable HSTS for production only, so local HTTP development is unaffected.
• Set X-Content-Type-Options: nosniff, X-Frame-Options, and a strict Referrer-Policy.
• Configure a Content-Security-Policy appropriate for the API, allowing Swagger UI to function at /api/docs.
• Disable the X-Powered-By header.
• Verify headers with a test asserting their presence on a sample response.

Acceptance Criteria

• Security headers are present on every response.
• Swagger UI still works.
• HSTS is production-only and covered by a test.

Notes for Contributors

Comment below to be assigned.