feat(security): add helmet middleware for HTTP security headers

Apply helmet at the Express layer to inject hardened response headers (CSP,
HSTS, frame and cross-origin policies) that protect browser clients against
injection vulnerabilities. The CSP connect-src is widened to https://*.stellar.org
so the app can still reach the required Stellar blockchain APIs (Horizon and
Soroban RPC, mainnet and testnet). Closes #84.

Author: manoahLinks

package-lock.json

@@ -54,6 +54,7 @@
     "compression": "^1.8.1",
     "dotenv": "^17.4.2",
     "express": "^5.2.1",
+    "helmet": "^8.2.0",
     "ioredis": "^5.6.1",
     "joi": "^17.13.3",
     "prisma": "^7.8.0",

package.json

@@ -2,6 +2,7 @@ import './tracing/tracing.bootstrap';
 import { NestFactory } from '@nestjs/core';
 import { ValidationPipe } from '@nestjs/common';
 import compression from 'compression';
+import helmet from 'helmet';
 import { AppModule } from './app.module';
 import { ConfigService } from './config/config.service';
 import { JsonLoggerService } from './common/logger/json-logger.service';
@@ -20,6 +21,29 @@ async function bootstrap() {
 
   const configService = app.get(ConfigService);
 
+  // ── HTTP security headers (issue #84) ─────────────────────────────────────
+  // Helmet injects a hardened set of response headers (CSP, HSTS, frame and
+  // cross-origin policies, etc.) to protect browser clients against injection
+  // vulnerabilities. The CSP connect-src is widened to the Stellar network so
+  // the app can still reach the required blockchain API systems (Horizon and
+  // Soroban RPC, on both mainnet and testnet).
+  app.use(
+    helmet({
+      contentSecurityPolicy: {
+        useDefaults: true,
+        directives: {
+          defaultSrc: ["'self'"],
+          connectSrc: ["'self'", 'https://*.stellar.org'],
+          objectSrc: ["'none'"],
+          frameAncestors: ["'self'"],
+          upgradeInsecureRequests: [],
+        },
+      },
+      // This service is a JSON API consumed by separate frontend origins.
+      crossOriginResourcePolicy: { policy: 'cross-origin' },
+    }),
+  );
+
   // ── CORS – restrict to known frontend origins (issue #85) ─────────────────
   const allowedOrigins = configService.getAllowedOrigins();