security: add helmet, rate limiting, webhook auth, fix token storage, restrict hard deletes

- Add helmet for HTTP security headers (CSP, HSTS, X-Frame-Options, etc.)
- Add @nestjs/throttler for rate limiting (100 req/60s per IP)
- Add shared secret validation on Signal webhook endpoint
- Remove JWT token from localStorage, use Auth0 SDK memory cache
  with async getAccessTokenSilently() in API interceptor
- Restrict hard delete (?hard=true) to ADMINISTRATOR role in service layer
- Replace exposed Anthropic API key with placeholder in .env

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/src/events/events.controller.ts

@@ -13,6 +13,7 @@ import { EventsService } from './events.service';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
 import { RolesGuard } from '../auth/guards/roles.guard';
 import { Roles } from '../auth/decorators/roles.decorator';
+import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import { Role } from '@prisma/client';
 import { CreateEventDto, UpdateEventDto, UpdateEventStatusDto } from './dto';
 
@@ -59,8 +60,9 @@ export class EventsController {
   remove(
     @Param('id') id: string,
     @Query('hard') hard?: string,
+    @CurrentUser() user?: any,
   ) {
     const isHardDelete = hard === 'true';
-    return this.eventsService.remove(id, isHardDelete);
+    return this.eventsService.remove(id, isHardDelete, user?.role);
   }
 }

backend/src/events/events.service.ts

@@ -2,6 +2,7 @@ import {
   Injectable,
   NotFoundException,
   BadRequestException,
+  ForbiddenException,
   Logger,
 } from '@nestjs/common';
 import { PrismaService } from '../prisma/prisma.service';
@@ -248,7 +249,11 @@ export class EventsService {
     return this.enrichEventWithVips(updatedEvent);
   }
 
-  async remove(id: string, hardDelete = false) {
+  async remove(id: string, hardDelete = false, userRole?: string) {
+    if (hardDelete && userRole !== 'ADMINISTRATOR') {
+      throw new ForbiddenException('Only administrators can permanently delete records');
+    }
+
     const event = await this.findOne(id);
 
     if (hardDelete) {