fix(security): wire Helmet, CORS, Swagger, and global exception filter in main.ts

[Josue19-08]

🔖 Title

Wire Helmet, CORS, Swagger, and global exception filter — all currently missing from `main.ts`

---

📄 Description

`src/main.ts` bootstraps the Fastify app but never enables several critical production requirements that are already partially configured in the codebase:

• Helmet is installed (`package.json`) but `app.register(helmet)` is never called → no HTTP security headers (CSP, HSTS, X-Frame-Options, etc.)
• CORS is not configured → all cross-origin requests are either blocked or unconstrained depending on Fastify defaults
• Swagger — `src/config/swagger.ts` exists and defines the document options but is never imported or mounted → no API docs available
• Global exception filter — `docs/development/guards-filters.md` documents the expected `HttpExceptionFilter` registered via `APP_FILTER`, but `src/common/filters/` contains only a `.gitkeep`. Unhandled errors currently leak raw stack traces and internal messages in the HTTP response body.

---

✅ Tasks to complete

• Create `src/common/filters/http-exception.filter.ts` — catches `HttpException`, returns structured `{ code, message, statusCode }` response
• Create `src/common/filters/all-exceptions.filter.ts` — catch-all for non-HTTP errors; logs internally, returns generic 500 without leaking stack traces
• Register both filters via `APP_FILTER` in `src/app.module.ts`
• Register `@fastify/helmet` in `src/main.ts` with production-safe CSP defaults
• Configure CORS in `src/main.ts` using `CORS_ORIGIN` env var (add to `src/config/env.ts` validation)
• Import and mount Swagger using `src/config/swagger.ts` in `src/main.ts` (behind a `NODE_ENV !== 'production'` guard or with bearer auth)
• Add unit tests for both filters in `test/unit/common/filters/`

---

📚 Documentation/context for AI

(This link never should removed)
https://github.com/TrustUp-app/TrustUp-API/tree/main/docs

Relevant files:

• `src/main.ts`
• `src/config/swagger.ts`
• `src/config/env.ts`
• `src/app.module.ts`
• `src/common/filters/` (currently empty)

---

🗒️ Additional notes

• Swagger should be conditionally mounted: available in `development` and `staging`, disabled or bearer-protected in `production`
• For helmet + Fastify adapter use: `await app.register(require('@fastify/helmet'), { ... })` before `app.listen()`
• CORS allowed origins should come from `ConfigService` to avoid hardcoding
• The all-exceptions filter must log the original error with full stack before sending the 500 response

[Achievers-sketch]

I’d like to implement this by securing main.ts with Helmet, CORS, Swagger, global exception filters, environment validation, and tests.