Add security regression tests for all hardening fixes

- New: test_security_headers.py — verify all headers present, HSTS conditional on HTTPS
- New: test_passkey_error_handling.py — generic vs user-facing error messages
- New: test_poi_validation.py — field length and coordinate range constraints
- Extend test_rate_limiter.py — client IP depth selection, in-memory fallback enforcement
- Extend test_models.py — sqm range validation
- Extend test_task_service.py — IDOR 404, ownership 200, traceback suppression in production

tests/unit/test_models.py

@@ -445,6 +445,15 @@ class TestQueryParametersValidation:
                 max_bedrooms=3,
             )
 
+    def test_invalid_sqm_range_raises(self) -> None:
+        """min_sqm > max_sqm should raise ValidationError."""
+        with pytest.raises(ValidationError, match="min_sqm.*must be <= max_sqm"):
+            QueryParameters(
+                listing_type=ListingType.RENT,
+                min_sqm=100,
+                max_sqm=50,
+            )
+
 
 class TestDestinationMode:
     """Tests for DestinationMode."""