feat: add security middleware suite - CSRF, security headers, and request logging (#102)

Implements three security middleware components with full test coverage:

- CSRF Protection: Token generation/validation, safe method allowlist,
  auto-exempt webhooks, constant-time comparison for timing attack prevention

- Security Headers: X-Content-Type-Options, X-Frame-Options, CSP,
  Permissions-Policy, Referrer-Policy, HSTS (production)

- Request Logging: Method/path/status/duration logging with correlation IDs,
  configurable path exclusions, X-Forwarded-For support

Also fixes Discord test isolation issue where settings.discord_token
was not being properly reset between tests.

New files:
- src/dashboard/middleware/{csrf,security_headers,request_logging}.py
- tests/dashboard/middleware/test_{csrf,security_headers,request_logging}.py

Addresses design review recommendations R3, R8, R9, R4.

All tests pass: 1950 passed, 40 skipped

Co-authored-by: Alexander Payne <apayne@MM.local>

src/dashboard/middleware/__init__.py

@@ -0,0 +1,14 @@
+"""Dashboard middleware package."""
+
+from .csrf import CSRFMiddleware, csrf_exempt, generate_csrf_token, validate_csrf_token
+from .security_headers import SecurityHeadersMiddleware
+from .request_logging import RequestLoggingMiddleware
+
+__all__ = [
+    "CSRFMiddleware",
+    "csrf_exempt",
+    "generate_csrf_token",
+    "validate_csrf_token",
+    "SecurityHeadersMiddleware",
+    "RequestLoggingMiddleware",
+]