[VULN-26] Missing Standard Security Headers

[lyncmi07]

Severity: Medium
Affected area: HTTP response headers (global)

Issue:
Common security headers are absent (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, HSTS), reducing defense-in-depth.

Mitigation plan:

1. Add a centralized security-header middleware/helper.
2. Set X-Content-Type-Options: nosniff, X-Frame-Options: DENY, strict Referrer-Policy, minimal Permissions-Policy.
3. Enable HSTS in HTTPS production environments.

Verification / tests:

• Header tests on key routes to assert all expected security headers.