fix(securitate): inchide nit-urile din review-ul hardening (N1-N3)

- N1: test HSTS pe monkeypatch.setenv (fara env var scursa la assert picat)
- N2: backup_db.sh refuza AUTOPASS_BACKUP_KEEP < 1 (retentia ar fi sters
  backup-ul abia creat)
- N3: teste ASGI directe pentru Content-Length malformat/negativ in
  BodyCapMiddleware (comportamentul defensiv exista deja, acum e fixat in teste)

Suita completa: 1559 passed, 1 skipped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_security_headers.py

@@ -45,11 +45,9 @@ def test_hsts_absent_pe_http(client):
     assert "Strict-Transport-Security" not in r.headers
 
 
-def test_hsts_prezent_pe_https():
+def test_hsts_prezent_pe_https(monkeypatch):
     tmp = tempfile.mkdtemp()
-    import os as _os
-
-    _os.environ["AUTOPASS_DB_PATH"] = _os.path.join(tmp, "sh_https.db")
+    monkeypatch.setenv("AUTOPASS_DB_PATH", os.path.join(tmp, "sh_https.db"))
     from app.config import get_settings
     get_settings.cache_clear()
     from app.main import app
@@ -61,4 +59,3 @@ def test_hsts_prezent_pe_https():
             "max-age=31536000; includeSubDomains"
         )
     get_settings.cache_clear()
-    _os.environ.pop("AUTOPASS_DB_PATH", None)