v1.0.17

Keep document responses out of caches. The five endpoints that return an uploaded document or metadata derived from one — /v1/mask, POST /v1/jobs, GET /v1/jobs/{id}, GET /v1/jobs/{id}/result and /v1/history — emitted no cache directives at all, which makes them eligible for RFC 7234 heuristic caching. The result download was the worst case: http.ServeContent adds a Last-Modified header, giving shared proxies and browser disk caches exactly the freshness hint they need to keep a copy of a masked file, so a document could survive in a cache long after the retention sweeper (PII_MASKER_JOB_RETENTION_HOURS) had deleted it from the server's disk.

A new documentResponse wrapper is applied at routing time and sets Cache-Control: no-store together with X-Content-Type-Options: nosniff, so clients cannot re-sniff a MIME type the server already declared. Endpoints that never carry a document — /v1/health, /v1/config/public and the static UI files — are deliberately left out.

An integration test checks both headers on all five endpoints and asserts that /v1/health is unchanged; temporarily reverting the wrapper confirms it fails (Cache-Control = "" for /v1/mask). gofmt -l (no output), go vet ./..., go build ./..., go test -count=1 ./... and go test -race -count=3 ./... all pass. The README documents which responses now carry which headers.