feat: attach standard security headers to all API responses

src/app/api/health/route.ts

@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { withApiHandler } from "@/lib/backend/withApiHandler";
 import { ok, methodNotAllowed } from "@/lib/backend/apiResponse";
 import { logInfo } from "@/lib/backend/logger";
-import { attachSecurityHeaders } from "@/utils/response";
+import { ok } from "@/lib/backend/apiResponse";
 
 export const GET = withApiHandler(async (req: NextRequest) => {
   logInfo(req, "Healthcheck requested");

src/app/api/ready/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from 'next/server';
+import { withApiHandler } from '@/lib/backend/withApiHandler';
 import { logger } from '@/lib/backend';
 import { methodNotAllowed } from '@/lib/backend/apiResponse';
 
@@ -37,7 +38,7 @@ async function checkSorobanRpc(): Promise<{ reachable: boolean; latencyMs?: numb
   }
 }
 
-export async function GET() {
+export const GET = withApiHandler(async () => {
   logger.info('Readiness check requested');
 
   const rpc = await checkSorobanRpc();

tests/api/commitments.test.ts

@@ -89,7 +89,7 @@ describe('GET /api/commitments', () => {
     expect(Array.isArray(result.data.data.items)).toBe(true)
   })
 
-  it('should return commitments filtered by status', async () => {
+  it('should include security headers on response', async () => {
     const request = createMockRequest(
       'http://localhost:3000/api/commitments?ownerAddress=GOWNER&status=active'
     )

tests/api/health.test.ts

@@ -48,7 +48,7 @@ describe('GET /api/health', () => {
     expect(timestamp.toString()).not.toBe('Invalid Date')
   })
 
-  it('should return version in response', async () => {
+  it('should include security headers', async () => {
     const request = createMockRequest('http://localhost:3000/api/health')
     const response = await GET(request, createMockRouteContext())
     const result = await parseResponse(response)