security: API key rotation grace period, encryption at rest, CSP headers, SQL injection prevention

[hardcordev]

Summary

Hardens the API against four security gaps: immediate (no grace-period) API key rotation, database/secrets encryption relying on AWS default-managed keys instead of a dedicated key, CSP headers that were written but never applied, and a "safe" SQL query helper plus a raw-SQL repository that both allowed unescaped values/identifiers into query strings.

Changes

• API key rotation (grace period + usage tracking): added backend/src/services/keys/rotation.ts with rotateApiKeyWithGracePeriod (keeps the predecessor key active until a configurable grace-period deadline while issuing a new key) and settleGracePeriod (lazy expiry once the deadline passes). Wired into backend/src/routes/api-keys.ts's /rotate, list, get, and usage endpoints, which now also report rotation/grace-period status. Added rotatedAt, gracePeriodEndsAt, predecessorKeyId, successorKeyId columns to the ApiKey model plus a matching migration.
• Encryption at rest: added a customer-managed KMS key (infra/main.tf) and wired it into RDS storage encryption, RDS Performance Insights, both Secrets Manager secrets, and the AWS Backup vault, replacing reliance on AWS default-managed keys.
• CSP / XSS prevention: applied the existing (previously unused) contentSecurityPolicy() middleware in backend/src/index.ts, and added the equivalent CSP plus supporting security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy) to frontend/next.config.ts.
• SQL injection prevention: SQLInjectionPrevention.createSafeQuery in backend/src/middleware/security.ts no longer interpolates escaped values into the query string — it now returns genuinely parameterized $n placeholders for the caller to bind. TimescaleRepository.ts's dynamic table/column identifiers (which can't be parameterized) are now validated against a strict allowlist before being interpolated.

Issues

Resolves #756
Resolves #754
Resolves #751
Resolves #750

Verification

Manual code review completed for every change (git status / diff / full diff reviewed file-by-file). cargo build and cargo test were not run — verification was manual review only, per repository guidance. No snapshots were added or modified.

[drips-wave]

@hardcordev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@hardcordev is attempting to deploy a commit to the smartdevs17's projects Team on Vercel.

A member of the Team first needs to authorize it.