Production HSTS hardening: preload, no-store on error pages, and CSP report-only diagnostic #215

Problem Statement. buildHelmetOptions in app/backend/src/common/security/security.module.ts
sets HSTS preload: true only when NODE_ENV === 'production'. There is no test
asserting the header is present, no automated check for misconfigurations, and no
report-uri for CSP violations — a regression can silently drop security headers without any
alert.

Why it matters. These are baseline, browser-enforced protections. Their absence is
indistinguishable from a healthy deploy without instrumentation.

Technical Context. Helmet is installed and wired; the secure-headers default profile
covers most directives but not report-uri for Content-Security-Policy.

Expected Outcome. A security-headers.e2e-spec.ts runs in CI against a staging boot
and asserts every required header (Strict-Transport-Security, X-Content-Type-Options,
Referrer-Policy, Cross-Origin-Resource-Policy, X-Frame-Options,
Cross-Origin-Opener-Policy) is present in production-mode responses and absent in
development for the dev-only overrides.

Acceptance Criteria.

• E2E test that boots with NODE_ENV=production and verifies the headers above.
• The CSP directive also has report-uri /api/v1/csp-report (see [CRITICAL] Remove hardcoded encryption fallback key from EncryptionService #11).
• Test framework parses the headers and complains if any are missing or misspelled.

Implementation Notes. Extend the existing Helmet Options builder rather than
overriding in middleware.

Files or modules likely to be affected. src/common/security/security.module.ts,
app/backend/test/security-headers.e2e-spec.ts (new).

Dependencies. #11 (CSP report endpoint).

Difficulty. Easy
Estimated effort. S

Backlog item #7 from `docs/maintainer-issue-backlog.md.