security: add helmet, rate limiting, webhook auth, fix token storage, restrict hard deletes

- Add helmet for HTTP security headers (CSP, HSTS, X-Frame-Options, etc.)
- Add @nestjs/throttler for rate limiting (100 req/60s per IP)
- Add shared secret validation on Signal webhook endpoint
- Remove JWT token from localStorage, use Auth0 SDK memory cache
  with async getAccessTokenSilently() in API interceptor
- Restrict hard delete (?hard=true) to ADMINISTRATOR role in service layer
- Replace exposed Anthropic API key with placeholder in .env

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docker-compose.yml

@@ -80,6 +80,7 @@ services:
       DATABASE_URL: postgresql://postgres:changeme@postgres:5432/vip_coordinator
       REDIS_URL: redis://redis:6379
       SIGNAL_API_URL: http://signal-api:8080
+      SIGNAL_WEBHOOK_SECRET: ${SIGNAL_WEBHOOK_SECRET:-}
       TRACCAR_API_URL: http://traccar:8082
       TRACCAR_DEVICE_PORT: 5055
       AUTH0_DOMAIN: ${AUTH0_DOMAIN}