feat(security): API security middleware, pipeline guard, and OWASP scanner

[femi23]

Summary

• src/climatevision/security/api_security.py — OWASP-aligned FastAPI middleware:
  • Per-API-key sliding-window rate limiter
  • Payload size + Content-Length checks
  • bbox sanity validation (range, ordering, max area to block DoS-via-huge-GEE-queries)
  • File upload validation by magic bytes + extension whitelist
  • Input sanitisation against XSS, SQLi, template-injection patterns
  • Security response headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection)
• src/climatevision/security/pipeline_guard.py — InputAnomalyDetector + PipelineGuard:
  • Statistical input checks (out-of-range pixels, NaN/Inf, suspicious uniformity, gradient analysis)
  • Output validation (single-class dominance, low confidence, uniform probabilities)
  • Returns structured security metadata so the API can warn callers
• tests/test_security.py — unit tests for the rate limiter, validators, sanitiser, and pipeline guard.
• scripts/security_scan.py — external scanner that probes a running API for OWASP misconfigurations (missing headers, unauthenticated POSTs, oversized payloads, bbox over-area). Outputs a JSON report.

Why

Closes the auth-enforcement primitives in gap #4 and lays the foundation for gap #5 (alert delivery integrity) and gap #7 (test coverage on security-sensitive paths).

The pipeline guard is the second line of defence after schema validation — it catches adversarial tiles that pass the input contract but break model assumptions (NaN injection, gradient-spike attacks, uniform-region patches). The output checks flag single-class-dominant predictions that often indicate either an attack or a model failure, before the result reaches the dashboard.

The OWASP scanner is intended to run in CI against a staged deployment and gate releases.

Test plan

• pytest tests/test_security.py -v passes
• python scripts/security_scan.py --target http://localhost:8000 produces a JSON report
• Send a 60 MB payload and confirm 413 response
• Hit /api/predict 101 times in one minute from one API key and confirm 429 with Retry-After

Note

Defence-in-depth — this does not replace the per-endpoint X-API-Key enforcement work in api/auth.py (gap #4 proper, separate PR).

[obielin]

Heavier overlap with my security/ territory than I'd like, but the implementation is solid — the OWASP scanner script is genuinely useful and the api_security middleware covers the input-sanitisation gap I had on my sprint backlog. I'm happy to inherit ownership going forward and layer my pipeline_guard adversarial-detection work on top in a follow-up.

Approving — let's merge and split future security work explicitly: input/middleware stays in your lane, ML-adversarial / model governance stays in mine.