CORS 和安全头

// 在 ApiPipelineRegistration 中配置
// 开发环境：宽松以支持本地开发
// 生产环境：限制为已知来源

{
  "Cors": {
    "AllowedOrigins": ["https://app.example.com", "https://admin.example.com"],
    "AllowedMethods": ["GET", "POST", "PUT", "PATCH", "DELETE"],
    "AllowedHeaders": ["Content-Type", "Authorization", "X-Idempotency-Key",
                       "X-Correlation-Id", "X-Signature", "X-API-Key"],
    "AllowCredentials": true,
    "MaxAgeSeconds": 3600
  }
}

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 0  (已弃用，优先使用 CSP)
Referrer-Policy: strict-origin-when-cross-origin
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'
Permissions-Policy: camera=(), microphone=(), geolocation=()

services.AddSingleton<INonceStore, MemoryNonceStore>();