Add security headers, pin AllowedHosts and honor forwarded headers

Tier 2 — security

Problem

• No security headers are emitted: no CSP, X-Content-Type-Options, Referrer-Policy or X-Frame-Options.
• AllowedHosts is "*", so the app answers to any Host header (host-header injection into generated links, cache poisoning).
• UseForwardedHeaders is not configured even though the app runs behind the App Service reverse proxy, so the scheme and client IP seen by the app are the proxy's — affecting redirects, logging and any future IP-based rate limiting.

Evidence

• LearnStack/appsettings.json:11 — "AllowedHosts": "*"
• LearnStack/Program.cs:76-95 — no headers middleware, no UseForwardedHeaders

Proposed fix

1. Add a middleware emitting the standard header set; start CSP in report-only mode since MudBlazor and Google Fonts need allowances, then enforce.
2. Pin AllowedHosts to the production domain(s).
3. UseForwardedHeaders with ForwardedHeaders.XForwardedFor | XForwardedProto early in the pipeline.

Acceptance criteria

• securityheaders.com grade A or better
• Requests with an unexpected Host are rejected
• Logs show real client IPs and the correct scheme

Start with LearnStack/appsettings.json:11 and LearnStack/Program.cs:76-95; review the current request pipeline and App Service deployment settings. Define the production host allowlist and CSP allowances, then verify the requested headers, forwarded scheme and client IP, unexpected-Host rejection, and securityheaders.com grade.