Sprint 5 : integration et production -- securite, performance, API publique, documentation

Backend: rate limiter, security headers, blockchain cache service avec RPC,
public API (7 endpoints read-only), WebSocket auth + heartbeat, DB connection
pooling, structured logging, health check DB. Frontend: API retry/timeout,
WebSocket auth + heartbeat + typed events, notifications toast, mobile hamburger
+ drawer, error boundary, offline banner, loading skeletons, dashboard enrichi.
Documentation: guides utilisateur complets (demarrage, vote, sanctuaire, FAQ 30+),
guide deploiement, politique securite. 123 tests, 155 fichiers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/middleware/security_headers.py

@@ -0,0 +1,42 @@
+"""Security headers middleware: adds hardening headers to all responses.
+
+Applies OWASP-recommended security headers to prevent common
+web vulnerabilities (clickjacking, MIME sniffing, XSS, etc.).
+"""
+
+from __future__ import annotations
+
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import Response
+
+
+class SecurityHeadersMiddleware(BaseHTTPMiddleware):
+    """Add security headers to all HTTP responses.
+
+    Headers applied:
+    - ``X-Content-Type-Options: nosniff``
+    - ``X-Frame-Options: DENY``
+    - ``X-XSS-Protection: 1; mode=block``
+    - ``Referrer-Policy: strict-origin-when-cross-origin``
+    - ``Content-Security-Policy: default-src 'self'``
+    - ``Strict-Transport-Security: max-age=31536000; includeSubDomains``
+      (only when the request was made over HTTPS)
+    """
+
+    async def dispatch(self, request: Request, call_next) -> Response:
+        response = await call_next(request)
+
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["X-Frame-Options"] = "DENY"
+        response.headers["X-XSS-Protection"] = "1; mode=block"
+        response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
+        response.headers["Content-Security-Policy"] = "default-src 'self'"
+
+        # Only add HSTS header for HTTPS requests
+        if request.url.scheme == "https":
+            response.headers["Strict-Transport-Security"] = (
+                "max-age=31536000; includeSubDomains"
+            )
+
+        return response