But I'm confused: do I really need a resistor if I limit the PWM output to 3.3v (as in my code) ?
PWM 3.3v only means that the arduino is outputing 5v 3.3v/5v = 66% of the time, and 0v 33% of the time.
However, the answer to your question is yes and no.
Yes, you need a resistor for a proper design.
No, you don't need a resistor as the pin's internal limitations in its current capabilities serve as a "resistor", and the diodes are one of those electronic devices that can take a lot of abuses temporarily.
I would put one in myself. But I would encourage you to experiment by not putting one in just to see for yourself.
In case you are asking, I have shorted avr's output pins (when outputting a logic 1) without damaging any.