apply full hardened headers to global 500 handlers

[nandinigoyaldev]

Global 500 error handlers in backend/app.py were returning JSON responses with only a couple security headers set manually. This caused the full hardened security header set (including Content-Security-Policy, Strict-Transport-Security, etc.) to be missing/incomplete on 500 responses.

This PR ensures the full hardened header set produced by _apply_security_headers() is applied to 500 responses returned by:

@app.errorhandler(Exception)
@app.errorhandler(SQLAlchemyError)

What Changed

backend/app.py

Updated both global 500 handlers to call _apply_security_headers(response) before returning.
Removed the previous partial manual header setting to avoid divergence.
tests/test_security_headers_500.py

Added assertions that 500 responses produced by forced Exception and forced SQLAlchemyError contain the full hardened header set.

Testing

Added pytest coverage verifying these headers exist on 500 responses.
Run locally (if pytest is installed):

cd BiblioDrift && python3 -m pytest -q

Security Impact

Consistent defense-in-depth: browsers receive the same CSP/HSTS/etc. policies even when the server returns an error response.

Author: @goyaljiiiiii
Closes issue: #1204

[netlify]

❌ Deploy Preview for bibliodrift-dm failed. Why did it fail? →

Name	Link
🔨 Latest commit	a6f7f6c
🔍 Latest deploy log	https://app.netlify.com/projects/bibliodrift-dm/deploys/6a2234ef3743520007e3bf3c