rebuild(stage-15): complete governance and handoff

next/backend/bootstrap/application.py

@@ -12,6 +12,7 @@ from backend.database.migrations import MIGRATIONS, MigrationRunner
 from backend.http.errors import install_error_handlers
 from backend.http.request_context import install_request_context
 from backend.http.router import api_router
+from backend.http.security import install_security_headers
 from backend.jobs.screener import run_screener_scheduler
 
 logger = logging.getLogger(__name__)
@@ -58,6 +59,7 @@ def create_application(settings: Settings | None = None) -> FastAPI:
     application.state.settings = runtime
     application.state.container = container
     install_request_context(application)
+    install_security_headers(application)
     install_error_handlers(application)
     application.include_router(api_router, prefix="/api")
     if runtime.frontend_dist_directory.joinpath("index.html").is_file():
@@ -69,7 +71,10 @@ def create_application(settings: Settings | None = None) -> FastAPI:
                 raise HTTPException(status_code=404)
             candidate = frontend_root.joinpath(requested_path).resolve()
             if candidate.is_relative_to(frontend_root) and candidate.is_file():
-                return FileResponse(candidate)
-            return FileResponse(frontend_root / "index.html")
+                response = FileResponse(candidate)
+                if candidate.parent.name == "assets":
+                    response.headers["Cache-Control"] = "public,max-age=31536000,immutable"
+                return response
+            return FileResponse(frontend_root / "index.html", headers={"Cache-Control": "no-cache"})
 
     return application