feat: security header sweep for /api/me/devices (#594)

[thelmaoffiong]

Summary

Implements the security header sweep for /api/me/devices and /api/me/devices/:id/revoke as required by issue #594.

Changes

src/routes/devices.ts

• Imported securityHeaders from ../middleware/securityHeaders
• Mounted devicesRouter.use(securityHeaders) before requireAuth so the three headers are present on every response, including 401 unauthenticated responses

src/routes/devicesRevoke.ts

• Same — securityHeaders mounted before requireAuth on devicesRevokeRouter

src/index.ts

• Imported devicesRevokeRouter and mounted it at /api/me/devices/:id/revoke (it was defined but not yet wired up in the main app)

tests/devicesSecurityHeaders.test.ts (new)

13 focused tests covering:

• Content-Security-Policy, X-Content-Type-Options, Referrer-Policy individually on a 200 GET /api/me/devices response
• All three headers together asserted against API_SECURITY_HEADERS (single source of truth)
• CSP value verified as deny-all: default-src 'none'; frame-ancestors 'none'; base-uri 'none'
• Headers present on 401 unauthenticated responses (middleware fires before auth)
• All three headers on POST /api/me/devices/:id/revoke — 200, 400 (invalid UUID), 404 (device not found)

Headers Applied

Header	Value
Content-Security-Policy	default-src 'none'; frame-ancestors 'none'; base-uri 'none'
X-Content-Type-Options	nosniff
Referrer-Policy	no-referrer

Test Results

PASS tests/devicesSecurityHeaders.test.ts
  GET /api/me/devices — security headers
    ✓ sets Content-Security-Policy on a 200 response
    ✓ sets X-Content-Type-Options: nosniff on a 200 response
    ✓ sets Referrer-Policy: no-referrer on a 200 response
    ✓ sets all three headers on a 200 response with devices present
    ✓ header values match API_SECURITY_HEADERS constant (single source of truth)
    ✓ CSP policy is deny-all
  GET /api/me/devices — security headers present on 401 (unauthenticated)
    ✓ returns security headers even when requireAuth rejects the request
  POST /api/me/devices/:id/revoke — security headers
    ✓ sets Content-Security-Policy on a revoke 200 response
    ✓ sets X-Content-Type-Options on a revoke 200 response
    ✓ sets Referrer-Policy on a revoke 200 response
    ✓ sets all three security headers on a 200 revoke response
    ✓ sets all three security headers on a 404 response (device not found)
    ✓ sets all three security headers on a 400 response (invalid UUID)

Tests: 13 passed, 13 total

Closes #594

[drips-wave]

@thelmaoffiong Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

Merged into main via admin resolver (-X theirs).

[greatest0fallt1me]

LGTM ✅ green CI, clean work — merging!