fix(security): pre-launch security hardening audit & remediation (#320)

- Webhook HMAC: capture raw request bytes via express.json verify callback
  instead of re-serializing with JSON.stringify
- AES-256-GCM: use NIST-recommended 12-byte IV (backward compatible with
  existing 16-byte IVs)
- Node proxy tokens: add 1-year default expiry (previously no expiry)
- Host console env filtering: pattern-based approach blocking SECRET,
  PASSWORD, TOKEN, KEY, CREDENTIAL keywords (previously only 4 explicit keys)
- CORS: deny cross-origin requests when FRONTEND_URL is unset in production
  (previously fell back to allowing all origins)

backend/src/services/CryptoService.ts

@@ -4,7 +4,7 @@ import path from 'path';
 
 const ALGORITHM = 'aes-256-gcm';
 const KEY_LENGTH = 32; // 256 bits
-const IV_LENGTH = 16;
+const IV_LENGTH = 12; // NIST SP 800-38D recommended length for GCM
 const ENCRYPTED_PREFIX = 'enc:';
 
 export class CryptoService {