[Security] Missing Security Headers and HTTPS Enforcement

## Summary
Production settings lack critical security headers and HTTPS enforcement, leaving the application vulnerable to session hijacking, man-in-the-middle attacks, and clickjacking.

## Severity
🟠 **High** - Affects production security and user data protection

## Affected Files
- `settings/prod.py`
- `settings/staging.py`

## Missing Security Configurations

### 1. No HTTPS Redirect
**Missing**: `SECURE_SSL_REDIRECT`
**Impact**: Users can access the site over insecure HTTP, exposing data to interception.

### 2. Insecure Cookies
**Missing**:
- `SESSION_COOKIE_SECURE = True`
- `CSRF_COOKIE_SECURE = True`

**Impact**: Session and CSRF cookies can be transmitted over HTTP, allowing:
- Session hijacking
- Cookie theft via MITM attacks
- CSRF token exposure

### 3. No HSTS Protection
**Missing**:
- `SECURE_HSTS_SECONDS`
- `SECURE_HSTS_INCLUDE_SUBDOMAINS`
- `SECURE_HSTS_PRELOAD`

**Impact**:
- Protocol downgrade attacks possible
- No protection against SSL stripping
- Users vulnerable on first visit

### 4. Missing XSS Protection
**Missing**: `SECURE_BROWSER_XSS_FILTER = True`
**Impact**: Browser XSS filters not activated

### 5. Missing MIME Type Protection
**Missing**: `SECURE_CONTENT_TYPE_NOSNIFF = True`
**Impact**: Browsers may incorrectly interpret file types, leading to XSS

### 6. Insufficient Clickjacking Protection
**Current**: `X_FRAME_OPTIONS` not explicitly set
**Impact**: Site could be embedded in iframes for clickjacking attacks

### 7. Insecure Session Configuration
**Missing**:
- `SESSION_COOKIE_HTTPONLY = True`
- `SESSION_COOKIE_SAMESITE = "Lax"`
- `CSRF_COOKIE_HTTPONLY = True`
- `CSRF_COOKIE_SAMESITE = "Lax"`

**Impact**: JavaScript can access cookies, CSRF attacks easier

## Attack Scenarios

### Scenario 1: Session Hijacking
1. User logs in over HTTPS
2. User clicks HTTP link (downgraded)
3. Session cookie sent over HTTP
4. Attacker intercepts cookie on shared network
5. Attacker gains unauthorized access

### Scenario 2: MITM Attack
1. Attacker performs SSL stripping
2. User connects over HTTP (no HSTS)
3. All traffic visible to attacker
4. Credentials and data compromised

### Scenario 3: Clickjacking
1. Attacker embeds site in iframe
2. User thinks they're on legitimate site
3. Attacker tricks user into clicking hidden elements
4. Unauthorized actions performed

## Recommended Fix

Add to `settings/prod.py`:

```python
# Force HTTPS redirects
SECURE_SSL_REDIRECT = True

# Secure cookies
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = "Lax"
CSRF_COOKIE_HTTPONLY = True
CSRF_COOKIE_SAMESITE = "Lax"

# HTTP Strict Transport Security (HSTS)
SECURE_HSTS_SECONDS = 31536000 # 1 year
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True

# Prevent MIME sniffing
SECURE_CONTENT_TYPE_NOSNIFF = True

# Enable browser XSS protection
SECURE_BROWSER_XSS_FILTER = True

# Prevent clickjacking
X_FRAME_OPTIONS = "DENY"
```

Start by comparing settings/prod.py and settings/staging.py, then review Django’s security-setting behavior and the project’s deployment assumptions. Confirm how HTTPS redirects, secure cookies, HSTS, content-type protection, XSS settings, and clickjacking protection should apply in each environment. Done means the required protections are configured consistently and verified without breaking staging or production access.

Written by the indexing model from the issue text.