docs: correct middleware response flow comment

Fix middleware response flow description to accurately reflect LIFO behavior:
- Response flow is: Route Handler -> CORSMiddleware -> SecurityHeadersMiddleware
- CORSMiddleware processes first (adds CORS headers)
- SecurityHeadersMiddleware processes last (adds security headers without overriding CORS)

This is the desired behavior as security headers complement rather than override CORS headers.

Addresses Copilot review feedback

Author: DerekRoberts

backend-py/src/main.py

@@ -147,9 +147,9 @@ async def logging_middleware(request: Request, call_next):
 # for both requests and responses when using add_middleware.
 # Since CORSMiddleware is added first and SecurityHeadersMiddleware is added second,
 # SecurityHeadersMiddleware becomes the outermost layer and the response flow is:
-# Route Handler -> SecurityHeadersMiddleware -> CORSMiddleware
-# This ensures SecurityHeadersMiddleware processes the response first, then CORS.
-# Since security headers are set first, they won't be overridden by CORS headers.
+# Route Handler -> CORSMiddleware -> SecurityHeadersMiddleware
+# This ensures CORSMiddleware processes the response first (adding CORS headers),
+# then SecurityHeadersMiddleware adds additional security headers without overriding CORS.
 app.add_middleware(SecurityHeadersMiddleware)