Phase 2: Fix high-priority security and stability issues (H1-H7)

H1: Sanitize error endpoint context (strip tokens/passwords, limit depth/size)
H2: Rate limiter IP spoofing fix (trusted proxy CIDR check for X-Forwarded-For)
H3: CSRF middleware uses Redis singleton instead of per-request connection
H4: WebSocket origin verification added to both kommunikation and ai_ui_control
H5: Storage path traversal protection, get_url() returns relative URL not filesystem path
H6: Security headers middleware (HSTS, X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy)
H7: Forward-repair migration 0045 for databases that ran original 0021/0027

Also: add trusted_proxy_cidrs to config, add verify_ws_origin to auth

app/main.py

@@ -20,7 +20,7 @@ logger = logging.getLogger(__name__)
 from app.config import get_settings
 from app.core.db import close_engine, get_engine
 from app.core.error_codes import ApiError
-from app.core.middleware import CSRFMiddleware
+from app.core.middleware import CSRFMiddleware, SecurityHeadersMiddleware
 from app.core.monitoring import record_error, record_request
 from app.core.plugin_error_handler import wrap_plugin_route
 from app.core.service_container import get_container
@@ -314,6 +314,7 @@ def create_app() -> FastAPI:
         max_age=3600,
     )
     app.add_middleware(CSRFMiddleware)
+    app.add_middleware(SecurityHeadersMiddleware)
     app.add_middleware(RequestLoggingMiddleware)
 
     # ── Global exception handler — catch ALL unhandled exceptions ──