fix: wire CSP + RateLimit middleware in main.py (étaient définis mais pas branchés)

Audit v3.0.1: 2/21 features ✗ → CSP/rate-limit middleware
non importés dans main.py. Maintenant branchés.

app/main.py

@@ -12,6 +12,7 @@ from starlette.middleware.sessions import SessionMiddleware
 from app.config import settings
 from app.db import init_db
 from app.middleware.csrf import CSRFMiddleware
+from app.middleware.security import ContentSecurityPolicyMiddleware, RateLimitMiddleware
 from app.routers import dashboard, board, notes, api, auth, webhooks, collections, my_tasks, workspace, public_api, admin
 from app.routers.gitea import router as gitea_router
 from app.services.gitea_client import gitea
@@ -48,6 +49,8 @@ app = FastAPI(
 
 app.add_middleware(SessionMiddleware, secret_key=settings.app_secret_key, max_age=3600)
 app.add_middleware(CSRFMiddleware)
+app.add_middleware(ContentSecurityPolicyMiddleware)
+app.add_middleware(RateLimitMiddleware)
 app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_methods=["*"], allow_headers=["*"])
 
 app.include_router(auth.router)