fix(api): add security hardening headers

[thomasorgeval]

Summary

• Add a reusable API security headers middleware.
• Apply no-referrer, nosniff, deny-framing, and restrictive permissions-policy headers to all API responses.
• Cover the middleware with a focused unit test.

Expected impact

• Reduces browser-side attack surface for API and upload responses by default.
• Prevents MIME sniffing, clickjacking via framing, unnecessary referrer leakage, and accidental browser feature access.

Verification

• NX_DAEMON=false pnpm nx test api --skip-nx-cache
• NX_DAEMON=false pnpm nx typecheck api --skip-nx-cache
• pnpm format:check
• NX_DAEMON=false pnpm nx lint api --skip-nx-cache

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e30c2e3844

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Apply headers after raw responses are finalized

For routes that return a native Response instead of using context.json()/context.body()—notably the Better Auth handler mounted at /api/auth/*—Hono does not merge headers queued before await next() into that returned response unless context.res was already created. As a result, these hardening headers are missing from auth responses even though this middleware is registered globally; set them after await next() or otherwise ensure they are applied to the finalized response.

Useful? React with 👍 / 👎.