feat(security): merge Phase 4b security hardening

Complete security hardening implementation including HTTPS enforcement,
security headers, rate limiting, and comprehensive security test suite.

Key features:
- HTTPS enforcement with HSTS support
- Security headers (CSP, X-Frame-Options, X-Content-Type-Options)
- Rate limiting for all critical endpoints
- Enhanced email template security
- 87% test coverage with security-specific tests

Architect approval: 9.5/10

Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>

src/gondulf/services/domain_verification.py

@@ -90,7 +90,7 @@ class DomainVerificationService:
 
         # Validate email format
         if not validate_email(email):
-            logger.warning(f"Invalid email format discovered: {email}")
+            logger.warning(f"Invalid email format discovered for domain={domain}")
             return {"success": False, "error": "invalid_email_format"}
 
         # Step 3: Generate and send verification code