1f6a4183d4
- tests/test_security.py: 30 security regression tests covering secure headers, CSP directives, middleware ordering, DRF throttle configuration, and SecurityAuditMiddleware event-detection logic - tests/test_upload.py: 19 upload defense tests covering extension allow-list, byte-length limits, and magic-byte signature validation (polyglot / disguised executable detection) - pytest.ini: register 'security' and 'upload' markers (--strict-markers enforcement was already on) Security settings already committed in feat(TRA-233) via harness include: SECURE_REFERRER_POLICY, CSP_* directives, DEFAULT_THROTTLE_*, MAX_UPLOAD_SIZE, SESSION/CSRF cookie hardening, AWS presigned URL policy, and SecurityAuditMiddleware with dual-logger (access + security) pattern. Co-Authored-By: Paperclip <noreply@paperclip.ing>