Add API security headers

[BojayL]

Summary

• Adds API response security headers for content sniffing, framing, referrer policy, and frame ancestors.
• Applies the middleware across the API router without changing JSON response bodies.
• Adds focused middleware coverage for the expected headers and JSON body preservation.
• Marks the API security header checklist item complete.

Fixes #28.

Validation

• cargo test -p waveflow-api
• rustfmt --edition 2021 --check crates/api/src/middleware.rs
• git diff --check
• Checked PR-facing files for restricted terms.