fix: address code and security review findings for Phase 5

- Add nginx security headers (X-Frame-Options, X-Content-Type-Options, etc.)
- Fix postgres networking: add to app_network, comment out host port exposure
- Fix rate limit memory leak: add bounded eviction for stale thread entries
- Use immutable update pattern in rate limit check (no .append mutation)
- Extract _VERSION constant to avoid duplicate hardcoded version string

backend/app/main.py

@@ -93,7 +93,9 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
     await pool.close()
 
 
-app = FastAPI(title="Smart Support", version="0.5.0", lifespan=lifespan)
+_VERSION = "0.5.0"
+
+app = FastAPI(title="Smart Support", version=_VERSION, lifespan=lifespan)
 
 app.include_router(openapi_router)
 app.include_router(replay_router)
@@ -103,7 +105,7 @@ app.include_router(analytics_router)
 @app.get("/api/health")
 def health_check() -> dict:
     """Health check endpoint for load balancers and monitoring."""
-    return {"status": "ok", "version": "0.5.0"}
+    return {"status": "ok", "version": _VERSION}
 
 
 @app.websocket("/ws")