[Security] Insecure Default Configuration Settings

## Summary
The application has multiple insecure default configurations in `settings/common.py` that could lead to information disclosure, session hijacking, and CSRF attacks.

## Severity
🔴 **Critical** - Affects production security posture

## Affected Files
- `settings/common.py`

## Issues Found

### 1. Weak Default SECRET_KEY (Line ~28)
```python
SECRET_KEY = os.environ.get("SECRET_KEY", "random_secret_key")
```
**Problem**: If `SECRET_KEY` environment variable is not set, uses a hardcoded default value.
**Impact**: Session tokens become predictable, allowing session hijacking.

### 2. DEBUG Mode Enabled by Default (Line ~31)
```python
DEBUG = True
```
**Problem**: DEBUG mode enabled by default in base settings.
**Impact**:
- Exposes sensitive error pages with stack traces
- Shows SQL queries
- Reveals file paths and environment details
- Security violation for production deployments

### 3. Unrestricted CORS (Line ~216)
```python
CORS_ORIGIN_ALLOW_ALL = True
```
**Problem**: Allows cross-origin requests from ANY domain.
**Impact**:
- CSRF attack vector
- Unauthorized API access from malicious websites
- Data leakage

### 4. Empty ALLOWED_HOSTS (Line ~34)
```python
ALLOWED_HOSTS = []
```
**Problem**: Empty list in production could allow host header injection.
**Impact**: Potential for cache poisoning and password reset attacks.

## Security Impact
- **Information Disclosure**: DEBUG mode exposes sensitive system information
- **Session Hijacking**: Weak SECRET_KEY makes sessions predictable
- **CSRF Attacks**: Unrestricted CORS allows malicious websites to make requests
- **Compliance Issues**: Violates security best practices and compliance requirements

## Recommended Fix

### 1. Require SECRET_KEY from environment
```python
SECRET_KEY = os.environ.get("SECRET_KEY")
if not SECRET_KEY:
raise ValueError("SECRET_KEY environment variable must be set")
```

### 2. Set DEBUG to False by default
```python
DEBUG = False
```

### 3. Restrict CORS
```python
CORS_ORIGIN_ALLOW_ALL = False
CORS_ALLOWED_ORIGINS = [
# Define allowed origins per environment
]
```

### 4. Require ALLOWED_HOSTS configuration
```python
ALLOWED_HOSTS = os.environ.get("ALLOWED_HOSTS", "").split(",")
```

Start with the referenced settings/common.py lines for SECRET_KEY, DEBUG, ALLOWED_HOSTS, and CORS_ORIGIN_ALLOW_ALL. Review how these settings are supplied per environment and check the application's startup and request behavior when required values are absent or restricted. Done means insecure fallbacks and unrestricted defaults are removed without breaking configured deployments.

Written by the indexing model from the issue text.