Function security_headers 

pub async fn security_headers(request: Request, next: Next) -> Response

Add the security headers to every response.

Wired by the native host, outside the application’s own layers:

router.layer(axum::middleware::from_fn(rahti_native::security_headers))

Existing values are left alone. A page that set its own policy meant it, and a layer that overwrote it would be a layer that quietly widened somebody’s deliberate narrowing.