[P1] Add Security Headers Middleware

[tim-dickey]

Problem

Missing common security headers:

• No HSTS (HTTP Strict Transport Security)
• No CSP (Content Security Policy)
• No X-Frame-Options (clickjacking protection)
• No X-Content-Type-Options
• No X-XSS-Protection

Security Risk: Application vulnerable to common attacks.

Security Best Practices

• HSTS: Force HTTPS connections
• CSP: Prevent XSS attacks by restricting resource loading
• X-Frame-Options: Prevent clickjacking
• X-Content-Type-Options: Prevent MIME sniffing attacks

Proposed Solution

Create security headers middleware in backend/core/security_middleware.py and integrate with FastAPI application.

Acceptance Criteria

• All security headers present in responses
• CSP policy doesn't break functionality
• Tests verify headers are set correctly
• Documentation explains each header
• Security scan shows improved rating

Implementation Details

See: _bmad-output/implementation-artifacts/action-items-2026-02-02.md Section 10

Estimated Effort: 2 hours
Priority: P1 - Security Hardening
Source: Code Review 2026-02-02