refactor: enhance captcha validation and security policies

[GTPSHAX]

Overview

This pull request streamlines security configurations, cleans up legacy API endpoints, and makes CAPTCHA validation highly flexible. It unifies environment-based host parsing across applications and adds granular control over Content Security Policy (CSP) directives.

Key Changes

Security Middleware & CSP Updates

• Centralized Host Parsing: Introduced a reusable parseEnvHosts helper function in both apps/api/middleware/helmet.js and apps/web/middleware/helmet.js. This eliminates code duplication when reading trusted domains from environment variables.
• Granular CSP Rules: Expanded directives to securely allow Google Analytics and Google Tag Manager across script-src, img-src, and connect-src.
• Environment-Specific Policies: Improved developer experience by removing the upgrade-insecure-requests directive when running in a local development environment.
• Maintainability: Standardized policy structures using a base defaultDirectives configuration object across the codebase.

Flexible CAPTCHA Validation

• Provider Agnosticism: Refactored handle-generate-docx.js to dynamically evaluate and accept validation from either hCaptcha or Cloudflare Turnstile.
• Fail-Safe Fallback: The document generation handler will now gracefully skip verification if no CAPTCHA keys are configured in the environment, preventing broken workflows during local testing.

API Route Cleanup

• Removed dead code and reduced the application attack surface by deleting the deprecated /autofill-ai and /generate-docx endpoints from apps/web/routes/api/.

How to Test

1. Security Verification: Inspect the network headers on both the Web and API apps to verify that Google Analytics domains are permitted and that upgrade-insecure-requests is absent in development.
2. CAPTCHA Workflow:

• Test with hCaptcha enabled $\rightarrow$ document generation should succeed upon token verification.
• Test with Cloudflare Turnstile enabled $\rightarrow$ document generation should succeed upon token verification.
• Test with no CAPTCHA variables in your .env $\rightarrow$ request should bypass validation and succeed seamlessly.