fix(security,architecture): harden Helmet CSP, CORS callback, cascade webhook deactivation, and AuthService dependency injection