[api] Add security response headers middleware

[yinkscss]

Context

Phase 3 deliverables include security headers. API responses do not set standard hardening headers.

Problem

Browser clients and security scanners flag missing X-Content-Type-Options, X-Frame-Options, and related headers.

Proposed scope

• Add tower-http SetHeaderLayer or custom middleware
• Set nosniff, DENY frame ancestors, referrer policy
• HSTS header when TLS termination detected (optional env flag)

Acceptance criteria

• Public API responses include X-Content-Type-Options: nosniff
• X-Frame-Options: DENY or CSP frame-ancestors
• Headers applied without breaking JSON clients
• Listed in security checklist as complete

References

• crates/api/src/main.rs
• docs/ROADMAP.md Phase 3
• docs/security-checklist.md

[BojayL]

/claim
Opened PR #49 with API security response headers and focused middleware coverage.