feat(security): add CSRF header constants and security-headers endpoint

Move X-BanGUI-Request header name/value to backend/app/utils/constants.py as single source of truth. Add GET /api/v1/config/security-headers endpoint. Update csrf middleware, frontend api client, and docs to use shared constants.

backend/app/models/config.py

@@ -884,3 +884,21 @@ class ServiceStatusResponse(BanGuiBaseModel):
     total_failures: int = Field(default=0, ge=0, description="Aggregated current failure count across all jails.")
     log_level: str = Field(default="UNKNOWN", description="Current fail2ban log level.")
     log_target: str = Field(default="UNKNOWN", description="Current fail2ban log target.")
+
+
+# ---------------------------------------------------------------------------
+# Security headers
+# ---------------------------------------------------------------------------
+
+
+class SecurityHeadersResponse(BanGuiBaseModel):
+    """Security-relevant header names and values used by the frontend."""
+
+    csrf_header_name: str = Field(
+        ...,
+        description="Name of the custom header required for state-mutating requests.",
+    )
+    csrf_header_value: str = Field(
+        ...,
+        description="Required value of the CSRF header to pass validation.",
+    )