Redesign test framework: fix conftest, rewrite all tests, fix model index conflicts, fix black formatting

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/9d256101-34b6-4861-a8cf-7f86f32b54d5

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

backend/app/middleware/security.py

@@ -52,29 +52,29 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
 
         # Content Security Policy (CSP)
         # Restricts sources of content that can be loaded
-        # 
+        #
         # SECURITY TODO: Current CSP includes 'unsafe-inline' and 'unsafe-eval' which
         # weaken XSS protection. To remove these:
-        # 
+        #
         # For script-src 'unsafe-inline':
         # 1. Move all inline <script> tags from templates to external .js files
         # 2. OR implement CSP nonces for inline scripts (requires template changes)
         # 3. Convert any inline event handlers (onclick, etc.) to addEventListener
-        # 
+        #
         # For script-src 'unsafe-eval':
         # 1. Verify no code uses eval(), Function(), setTimeout/setInterval with strings
         # 2. If using libraries that require eval, consider alternatives
         # 3. Current scan shows no eval usage - can likely remove this directive
-        # 
+        #
         # For style-src 'unsafe-inline':
         # 1. Move inline styles to CSS files or use style tags with nonces
         # 2. Replace style="" attributes with CSS classes
         # 3. OR implement CSP nonces for inline styles
-        # 
+        #
         # Target secure CSP (no inline):
         # "script-src 'self'"
         # "style-src 'self' https://fonts.googleapis.com"
-        # 
+        #
         # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
         csp_directives = [
             "default-src 'self'",