refactor: change security headers default to disabled

Security headers are now disabled by default since most deployments use a reverse proxy (Traefik, Nginx) that already adds these headers. Enable with SECURITY_HEADERS_ENABLED=true for direct deployments.

Changes:
- Set security_headers_enabled default to False in app/config.py
- Update all documentation to reflect new default
- Comment out examples in .env.demo (now showing disabled state)
- Update SECURITY_AUDIT.md to reflect reverse proxy as default deployment
- Tests still pass (3 passed, 8 skipped as expected with headers disabled)

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

app/config.py

@@ -175,11 +175,11 @@ class Settings(BaseSettings):
     )
 
     # Security Headers Configuration (see SECURITY_AUDIT.md and docs/DeploymentGuide.md)
-    # When deploying behind a reverse proxy (Traefik, Nginx, etc.), disable these headers
-    # if your proxy already adds them to avoid duplication
+    # Disabled by default since most deployments use a reverse proxy (Traefik, Nginx, etc.)
+    # that already adds these headers. Enable if deploying directly without a reverse proxy.
     security_headers_enabled: bool = Field(
-        default=True,
-        description="Enable security headers middleware. Set to False if reverse proxy handles headers.",
+        default=False,
+        description="Enable security headers middleware. Set to True if deploying without reverse proxy.",
     )
 
     # Strict-Transport-Security (HSTS) - Forces HTTPS connections