fix: make security headers configurable and add tests

backend/.env.example

@@ -7,6 +7,11 @@ REQUEST_LOG_INCLUDE_HEALTH=false
 DATABASE_URL=postgresql+psycopg://postgres:postgres@localhost:5432/mission_control
 CORS_ORIGINS=http://localhost:3000
 BASE_URL=
+# Security response headers (blank values disable each header).
+SECURITY_HEADER_X_CONTENT_TYPE_OPTIONS=
+SECURITY_HEADER_X_FRAME_OPTIONS=
+SECURITY_HEADER_REFERRER_POLICY=
+SECURITY_HEADER_PERMISSIONS_POLICY=
 
 # Auth mode: clerk or local.
 AUTH_MODE=local