feat(missao-7): bloco D - endurecimento HTTP, cobertura de testes e runbook de disaster recovery

central/app/main.py

@@ -4,7 +4,7 @@ import logging
 import sys
 from collections.abc import Callable
 
-from fastapi import FastAPI, HTTPException
+from fastapi import FastAPI, HTTPException, Request
 from fastapi.staticfiles import StaticFiles
 from .config import settings
 from .db import SessionLocal, database_is_available
@@ -24,6 +24,17 @@ def create_app(database_probe: Callable[[], bool] = database_is_available, sessi
         raise RuntimeError("AGENT_DEV_TOKEN must not be set when APP_ENV=production (register real Agents with central/scripts/register_agent.py)")
     logger.info("starting GTI Fiscal Hub (environment=%s)", settings.environment)
 
+    @app.middleware("http")
+    async def add_security_headers(request: Request, call_next):
+        response = await call_next(request)
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["X-Frame-Options"] = "SAMEORIGIN"
+        response.headers["X-XSS-Protection"] = "1; mode=block"
+        response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
+        if getattr(settings, "web_cookie_secure", False):
+            response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+        return response
+
     @app.get("/health")
     def health() -> dict[str, str]:
         if not database_probe():