feat: add security headers middleware with report-only CSP

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/main.py

@@ -28,6 +28,7 @@ if settings.SENTRY_DSN:
 from app.core.database import init_db, async_session_maker
 from app.core.logging_config import setup_logging
 from app.core.middleware import RequestLoggingMiddleware, ErrorLoggingMiddleware
+from app.core.security_headers import SecurityHeadersMiddleware
 from app.core.rate_limit import limiter
 from app.api.router import api_router
 from app.core.scheduler import scheduler, load_all_schedules, _cleanup_expired_ai_conversations
@@ -234,6 +235,9 @@ else:
         expose_headers=["X-Redaction-Mode", "X-Redaction-Summary"],
     )
 
+# Add security headers middleware (after CORS so preflight responses work)
+app.add_middleware(SecurityHeadersMiddleware)
+
 # Include API router
 app.include_router(api_router, prefix=settings.API_V1_PREFIX)