Exports buildSecurityHeaders() (pure, testable) and wires it into the
Astro onRequest middleware. Adds astro:middleware alias in vitest config
so the unit tests run outside Astro's build context. 14 tests pass (7
existing + 7 new).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Captures brainstormed architecture: Astro 5 static site on Hetzner
Webhosting L, Cloudflare profile B (WAF, rate limit, HSTS, security
headers), redirect-to-Logto auth at auth.cameleer.io. Four pages (home,
pricing, imprint, privacy), English-only with i18n-ready scaffold, no
analytics in v1. Homepage uses dual-register 6-section weave serving
both manager and engineer audiences at every scroll depth.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>