Harden nest-profiler for production

The profiler exposes request headers, query params, bodies and logs through the /_profiler UI. Off in local dev that is a feature; anywhere reachable by others it is a data-exposure risk. This skill makes an already-configured profiler safe to run outside dev.

Core profiler not set up yet? → use setup-nest-profiler first (it picks the install and wires the collectors). This skill assumes a working ProfilerModule and only hardens it.

Installed as a dev dependency (loaded by a main-dev.ts entrypoint)? Then production never installs it, and there is nothing to harden there. To run it on an environment beyond local dev, the app must switch to the dependencies + ConditionalModule install first (see setup-nest-profiler, references/enable-strategies.md): move the profiler packages to dependencies, gate the ProfilingModule bundle with ConditionalModule.registerWhen(..., isProfilerEnabled), and wrap the logger / validation pipe in main.ts. A shared dev environment that runs the dev entry is covered by the access-control step below.

First, state the stance plainly: keep the profiler off in production by default. Enabling it is legitimate when the API is not publicly reachable (internal, behind a VPN) or the user has accepted the exposure — don't refuse, harden it. Confirm the user's intent before changing anything.

Checklist

Apply each, driven from ConfigService/env where the app already does so: