feat: harden production security boundaries

apps/api/tests/test_api.py

@@ -59,6 +59,8 @@ def test_liveness_does_not_probe_dependencies() -> None:
     response = client.get("/health?token=must-not-be-logged")
     assert response.json() == {"status": "ok"}
     assert len(response.headers["X-Request-ID"]) == 32
+    assert response.headers["X-Frame-Options"] == "DENY"
+    assert response.headers["Cross-Origin-Opener-Policy"] == "same-origin"
 
 
 def test_spot_detail_and_catches() -> None:
@@ -80,11 +82,13 @@ def test_records_list_is_empty_before_import() -> None:
 def test_user_report_requires_moderation_before_activity() -> None:
     created = client.post("/api/v1/catch-reports", json={"fish_slug": "pike", "waterbody_slug": "test-lake", "x": 77, "y": 88, "weight_g": 5500, "bait_name": "Новая приманка", "player_name": "Reporter"})
     assert created.status_code == 201
+    assert created.headers["Cache-Control"] == "no-store"
     assert created.json()["moderation_status"] == "pending"
     report_id = created.json()["id"]
     headers = {"Authorization": "Bearer change-me-in-production"}
     pending = client.get("/api/v1/admin/catch-reports", headers=headers)
     assert pending.status_code == 200
+    assert pending.headers["Cache-Control"] == "no-store"
     assert any(item["id"] == report_id for item in pending.json())
     approved = client.patch(f"/api/v1/admin/catch-reports/{report_id}", headers=headers, json={"status": "approved", "reason": "fixture verified"})
     assert approved.status_code == 200