🐛 expose conversation ID to browser clients

[ump45nose]

Summary

• expose the existing conversation_id response header through CORS
• cover the shared app factory and northbound app middleware configuration

Why

The agent endpoints already return conversation_id, but browser clients cannot read non-safelisted response headers unless Access-Control-Expose-Headers includes it. Static frontends therefore lose the ID even though it is present on the HTTP response.

Fixes #3610.

Tests

• FastAPI TestClient CORS smoke with an Origin request and conversation_id: 42
• python3 -m py_compile backend/apps/app_factory.py test/backend/app/test_config_app.py test/backend/app/test_northbound_base_app.py
• git diff --check