feat: Add security hardening, agentic coding infrastructure, and test framework

- Add SECRET_KEY and ENCRYPTION_KEY validation on startup
- Implement security headers middleware (X-Frame-Options, CSP, HSTS)
- Add CSRF protection middleware
- Create comprehensive GitHub issue templates and PR template
- Add Makefile with common development tasks
- Configure pre-commit hooks (black, ruff, mypy, bandit, detect-secrets)
- Create docs/CODING_PATTERNS.md with best practices
- Create docs/ERRORS.md documenting all error codes
- Add Architecture Decision Records (ADR) for Celery and Fernet encryption
- Create CHANGELOG.md for version tracking
- Set up pytest test infrastructure with fixtures and factories
- Add sample unit tests for security and config validation
- Create CI/CD workflows (test, lint, security)
- Add comprehensive TODO.md with milestones and progress tracking

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

backend/app/main.py

@@ -8,6 +8,7 @@ from fastapi.responses import JSONResponse
 import logging
 
 from app.core.config import settings
+from app.core.middleware import SecurityHeadersMiddleware, CSRFProtectionMiddleware
 from app.api.v1.api import api_router
 
 # Configure logging
@@ -31,6 +32,10 @@ def create_application() -> FastAPI:
         openapi_url="/api/openapi.json"
     )
     
+    # Security middleware (add before CORS)
+    app.add_middleware(SecurityHeadersMiddleware)
+    app.add_middleware(CSRFProtectionMiddleware)
+    
     # CORS middleware
     app.add_middleware(
         CORSMiddleware,