Fix HIGH Security Issue: Require ALLOWED_HOSTS in production

Added validation to ensure ALLOWED_HOSTS is explicitly set in production.

Changes:
- Check if ALLOWED_HOSTS environment variable is set
- Raise ValueError with helpful message if not set
- Use os.environ['ALLOWED_HOSTS'] instead of .get() to enforce requirement
- Prevents empty or missing ALLOWED_HOSTS from bypassing host validation

Security impact:
- Prevents host header injection attacks
- Blocks cache poisoning via host header manipulation
- Ensures production deployments have explicit allowed hosts configured
- Fails fast with clear error message if misconfigured

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

config/settings/production.py

@@ -10,7 +10,14 @@ from .base import *
 # Security
 SECRET_KEY = os.environ['SECRET_KEY']
 DEBUG = False
-ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '').split(',')
+
+# ALLOWED_HOSTS must be explicitly set in production
+if not os.environ.get('ALLOWED_HOSTS'):
+    raise ValueError(
+        "ALLOWED_HOSTS environment variable is required in production. "
+        "Set to comma-separated list of allowed domains (e.g., 'example.com,www.example.com')"
+    )
+ALLOWED_HOSTS = os.environ['ALLOWED_HOSTS'].split(',')
 
 # Force HTTPS
 SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')