[create-croco-app] Generated apps pass secure HTTP bootstrap by default

[kang-heewon]

Milestone

M0 - Foundation Freeze

Priority

P0

Problem

Croco's HTTP transport has a strong production posture, but generated apps and quickstart templates should demonstrate that posture by default. If templates rely on disabling security validation, users can copy the unsafe path into production.

Scope

• Make generated REST/Lambda apps pass the HTTP security middleware contract by default.
• Keep any validation bypass limited to explicit local-demo or migration paths.
• Ensure generated app smoke exercises production-like bootstrap.

Acceptance criteria

• Generated HTTP apps include security headers, CORS, body limit, and rate-limit middleware, or an explicit dev-only replacement with clear diagnostics.
• Template defaults do not require securityValidation: "off" for normal first-run success.
• A missing security middleware fixture fails with a deterministic CROCO_* diagnostic.
• Generated app smoke covers at least one production-like bootstrap path.
• Documentation explains how to disable validation only for local migration/testing scenarios.