feat: harden production security boundaries

apps/api/app/main.py

@@ -54,6 +54,10 @@ async def structured_request_log(request: Request, call_next):
         response.headers["X-Content-Type-Options"] = "nosniff"
         response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
         response.headers["Permissions-Policy"] = "camera=(), microphone=(), geolocation=()"
+        response.headers["X-Frame-Options"] = "DENY"
+        response.headers["Cross-Origin-Opener-Policy"] = "same-origin"
+        if request.url.path.startswith("/api/v1/admin/") or request.url.path == "/api/v1/catch-reports":
+            response.headers["Cache-Control"] = "no-store"
         if settings.deployment_environment == "production":
             response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
         return response
@@ -163,7 +167,8 @@ def records(
 
 
 def _admin(authorization: Annotated[str | None, Header()] = None) -> str:
-    if not authorization or authorization != f"Bearer {settings.admin_token}":
+    expected = f"Bearer {settings.admin_token}"
+    if not authorization or not hmac.compare_digest(authorization, expected):
         raise HTTPException(status_code=401, detail="invalid admin token", headers={"WWW-Authenticate": "Bearer"})
     return "admin"