Runtime shield pass: strict CORS, safer headers, and health visibility

[nottherealalanturing]

Summary

This PR implements the smallest backend hardening changes to satisfy the assigned production/security/health issues.

Included

• Global CORS configured from CORS_ORIGINS with strict whitelist + localhost allowance in non-production.
• Global Helmet security headers enabled.
• x-powered-by disabled and trust-proxy toggle added (TRUST_PROXY=true).
• Swagger remains disabled in production (enabled only in non-production).
• Public /health now checks database (SELECT 1), redis, and memory metadata.

Notes

• This is intentionally minimal and keeps behavior focused on startup/runtime config and health reporting.

Closes #502
Closes #503
Closes #504
Closes #505

[drips-wave]

@nottherealalanturing Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits