fix(securitate): inchide nit-urile din review-ul hardening (N1-N3)

- N1: test HSTS pe monkeypatch.setenv (fara env var scursa la assert picat)
- N2: backup_db.sh refuza AUTOPASS_BACKUP_KEEP < 1 (retentia ar fi sters
  backup-ul abia creat)
- N3: teste ASGI directe pentru Content-Length malformat/negativ in
  BodyCapMiddleware (comportamentul defensiv exista deja, acum e fixat in teste)

Suita completa: 1559 passed, 1 skipped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tools/backup_db.sh

@@ -32,6 +32,12 @@ RCLONE_REMOTE="${AUTOPASS_BACKUP_RCLONE_REMOTE:-}"
 log() { echo "[backup_db] $*"; }
 err() { echo "[backup_db] EROARE: $*" >&2; }
 
+if ! [[ "$KEEP" =~ ^[0-9]+$ ]] || [[ "$KEEP" -lt 1 ]]; then
+    err "AUTOPASS_BACKUP_KEEP trebuie sa fie un numar intreg >= 1 (primit: '$KEEP')."
+    err "cu KEEP=0 retentia ar sterge inclusiv backup-ul abia creat."
+    exit 1
+fi
+
 CLEANUP_PATHS=()
 cleanup() {
     local p