fix: secure production defaults

[0xNyk]

Summary

• Default DEBUG to False instead of True
• Generate random SECRET_KEY if not set (remove hardcoded fallback)
• Configure CORS origins from CORS_ORIGINS env var instead of wildcard *
• Default host to 127.0.0.1 instead of 0.0.0.0
• Add security headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection)

Test plan

• Verify backend starts with no env vars set
• Verify CORS_ORIGINS env var is respected
• Check response headers include security headers

[0xNyk]

Verification

All checks pass on merged code:

Test	Result
DEBUG defaults to False	✅ PASS
SECRET_KEY is random 64-char hex (not hardcoded)	✅ PASS
CORS_ORIGINS configurable from env	✅ PASS
Security headers in responses	✅ PASS
create_app() succeeds	✅ PASS

DEBUG default: False
SECRET_KEY is random: True
SECRET_KEY length: 64
CORS_ORIGINS: ['http://localhost:3000']