- Move CSP, HSTS, Referrer-Policy, and Permissions-Policy from next.config.ts to middleware
- Compose headers with next-intl middleware to ensure they propagate through rewrites
- Security headers now set via response.headers.set() in middleware after i18n routing
- All security headers should now appear in HTTP responses
Fixes QA issue: headers from next.config.ts not appearing due to middleware rewrites
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
damjan_savicandClaude Sonnet 4.5
cc1217e929