feat(TRA-247): M5 security hardening — tests, markers, and header enforcement
- tests/test_security.py: 30 security regression tests covering secure
headers, CSP directives, middleware ordering, DRF throttle configuration,
and SecurityAuditMiddleware event-detection logic
- tests/test_upload.py: 19 upload defense tests covering extension allow-list,
byte-length limits, and magic-byte signature validation (polyglot / disguised
executable detection)
- pytest.ini: register 'security' and 'upload' markers (--strict-markers
enforcement was already on)
Security settings already committed in feat(TRA-233) via harness include:
SECURE_REFERRER_POLICY, CSP_* directives, DEFAULT_THROTTLE_*, MAX_UPLOAD_SIZE,
SESSION/CSRF cookie hardening, AWS presigned URL policy, and
SecurityAuditMiddleware with dual-logger (access + security) pattern.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
1f6a4183d4