Add API anti-abuse hardening: disable docs in prod, origin validator, exception handler

- Disable OpenAPI docs/redoc/openapi.json when APP_ENV=production
- Strip uvicorn Server header with --no-server-header in Dockerfile and docker-compose.yml
- Add OriginValidatorMiddleware to reject state-changing requests from disallowed origins
- Add global exception handler to prevent stack trace leakage on unhandled errors
- Add tests for all new security features (OpenAPI, origin validation, exception handler, server header)

tests/unit/test_security_headers.py

@@ -54,3 +54,9 @@ class TestSecurityHeaders:
         client = TestClient(_build_app())
         resp = client.get("/test")
         assert "Strict-Transport-Security" not in resp.headers
+
+    def test_server_header_not_present(self) -> None:
+        """The Server header should not leak server software info."""
+        client = TestClient(_build_app())
+        resp = client.get("/test")
+        assert "Server" not in resp.headers or "uvicorn" not in resp.headers.get("Server", "").lower()