Add helmet for baseline HTTP security headers

[dzekojohn4]

Labels: area:backend, priority:high, security
Difficulty: Easy
Effort: 0.25 day
Dependencies: None

Problem Statement

Backend responses do not include a baseline of HTTPS / hardening headers (e.g. Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy). Browsers are free to MIME-sniff and load the API in risky frames.

Why It Matters

• Closes the gap on several OWASP A05 (Security Misconfiguration) items.
• Browsers will refuse to load the API response in an iframe from another origin (clickjacking protection).
• Adds XSS mitigation for any reflected content rendered from API errors.

Technical Context

• backend/src/main.ts uses enableCors but no security headers.
• The frontend is on Vercel, served over HTTPS in production.

Expected Outcome

Express response includes the OWASP-recommended default header set; CSP is configurable but starts as default-src 'self'.

Acceptance Criteria

• @nestjs/platform-express registers helmet() middleware.
• CSP allows the Vercel frontend host.
• Strict-Transport-Security set with max-age=63072000; includeSubDomains; preload.
• Swagger endpoint is reachable when CSP policy is enabled (or a separate CSP is applied).

Implementation Notes

• Configure helmet({ contentSecurityPolicy: { directives: { 'default-src': ["'self'"], 'img-src': ["'self'", 'data:', 'https://res.cloudinary.com'] }}}).
• Exclude /swagger paths from CSP via dynamic nonce.
• Tests assert each header is present.

Files / Modules Likely Affected

• backend/src/main.ts
• backend/src/config/app.config.ts
• backend/package.json

References

• https://helmetjs.github.io/
• https://owasp.org/www-project-secure-headers/

---

Imported from local backlog file 007-helmet.md (manual issue #7).