Brummel
f3d0380dbd
Attaches a SetResponseHeaderLayer stack to create_router_with_state (not main.rs) so tests observe the same response shape as production. `if_not_present` mode so per-route overrides (magic.rs already sets its own Referrer-Policy) are preserved. Sets: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Content-Security-Policy, Permissions-Policy. HSTS is deliberately omitted until TLS termination is in place — a cached max-age on a plain-HTTP deployment is irreversible. CSP uses 'unsafe-inline' for script/style since templates contain inline scripts; revisit if any user input ever renders unescaped. Removes #[ignore] from the 10 attack-confirming header tests; two regression anchors (no-HSTS, no-duplicated magic header) were already green.