fix(config): validate numeric env vars at boot; default Swagger off in production

[rmyndharis]

Summary

Two small production-hardening fixes.

Validate numeric env vars at boot

The rate-limit windows/limits (RATE_LIMIT_*), webhook WEBHOOK_TIMEOUT/WEBHOOK_MAX_RETRIES/WEBHOOK_RETRY_DELAY, and DATABASE_POOL_SIZE were read with an unbounded parseInt. A non-integer value (e.g. RATE_LIMIT_SHORT_LIMIT=abc) became NaN and silently disabled the corresponding limit. validateEnv now rejects a non-negative-integer violation at boot with a clear message, mirroring the existing PORT/DATABASE_PORT/REDIS_PORT checks. Unset vars and valid integers are unaffected.

Swagger off by default in production

/api/docs served the full API schema unauthenticated by default in every environment — reconnaissance surface. isSwaggerEnabled now factors in NODE_ENV: an explicit ENABLE_SWAGGER still wins ('true'/'false'); when unset it defaults on outside production, off in production. Operators who want it in production opt in with ENABLE_SWAGGER=true. The startup banner only prints the docs URL when Swagger is actually served.

Tests

• env.validation.spec.ts: rejects non-integer/negative/decimal rate-limit, webhook, and pool-size values; valid integers and unset still pass.
• bootstrap-security.spec.ts: production defaults off, explicit true still on, dev unchanged.
• Full gate: lint 0 · build OK · 1066 unit · 26 e2e pass.

Risk

Low. The env validation only rejects already-misconfigured (NaN-producing) values. The Swagger default flip is a behavior change for operators who relied on /api/docs in production without setting ENABLE_SWAGGER — they set ENABLE_SWAGGER=true. Dev/test default unchanged (so e2e and local docs still work).