[umpireboulianne-design]

Summary

• Add APPRAISAL_RESPONSE_SECURITY_HEADERS and withNonCacheableHeaders() in services/appraisal-api/src/server.ts so all appraisal responses (including 402 quote challenges, 200 paid appraisal responses, and error responses) include Cache-Control: no-store, Pragma: no-cache, Expires: 0, and X-Content-Type-Options: nosniff.
• Ensure upstream or facilitator headers cannot accidentally re-enable caching on time-bound appraisal quotes or paid valuations.
• Add deterministic unit and HTTP integration tests in services/appraisal-api/src/body-limit.test.ts and document the non-cacheable response contract in services/appraisal-api/README.md.

Supply-chain review

• No package scripts or dependencies changed. If changed, explain why below.
• No .vscode/, workflow, or other editor/config file changes. If changed, list them below.
• No lockfile changes. If changed, explain the update below.
• No binary or font asset changes. If changed, list and justify them below.
• I confirm no automatic task (such as preinstall/postinstall) was added.
• I confirm no hidden executable payload (encoded blob, obfuscated command, or unexpected binary) was added.
• Any changed executable or binary was reviewed by a maintainer.

Testing

• node --import tsx/esm --test services/appraisal-api/src/body-limit.test.ts services/appraisal-api/src/appraisal.test.ts services/appraisal-api/src/appraisal-fixtures.test.ts services/appraisal-api/src/config.test.ts

Closes #541
Fixes #541