Hardening Node.js Apps in Production: 8 Layers of Practical Security