Issue 003: Attach security headers middleware globally
Area: Backend
Priority: High
Files: services/api/src/main.rs, services/api/src/security.rs
Problem
Security headers middleware exists but is not mounted on all route groups. Some responses lack CSP, HSTS, and other security headers.
Acceptance Criteria
- Responses include CSP, HSTS, X-Frame-Options, and Referrer-Policy headers\n- No duplicate or conflicting headers\n- Tests validate header presence on all route groups\n- Headers are configurable per environment
Issue 003: Attach security headers middleware globally
Area: Backend
Priority: High
Files: services/api/src/main.rs, services/api/src/security.rs
Problem
Security headers middleware exists but is not mounted on all route groups. Some responses lack CSP, HSTS, and other security headers.
Acceptance Criteria