case 4727 - safe security headers on every response

Every response carries X-Content-Type-Options: nosniff, X-Frame-Options:
SAMEORIGIN and Referrer-Policy: strict-origin, so self-hosted installs
get them too (the hosted nginx sends the same values). F35 (4727 step 6).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/AyaNova/Startup.cs

@@ -338,6 +338,16 @@ namespace AyaNova
             //     await next.Invoke();
             // });
 
+            //case 4727 (F35): safe headers on every response, so self-hosted installs get them too (hosted droplets
+            //also get them from nginx: same values, so the duplicates agree)
+            app.Use(async (context, next) =>
+            {
+                context.Response.Headers["X-Content-Type-Options"] = "nosniff";
+                context.Response.Headers["X-Frame-Options"] = "SAMEORIGIN";
+                context.Response.Headers["Referrer-Policy"] = "strict-origin";
+                await next.Invoke();
+            });
+
 
             #region STATIC FILES
             _newLog.LogDebug("Static files");