feat: add OWASP security headers, integration tests, and performance baselines

- Add secureHeaders middleware to api/index.ts (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy)
- Add Auth → Permissions → Data → Audit E2E integration test suite (9 tests)
- Add CRUD performance baseline test suite targeting P95 < 100ms (6 tests)
- Add @objectos/permissions as dev dependency for cross-plugin integration tests

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

api/index.ts

@@ -9,6 +9,7 @@
  */
 import { handle } from '@hono/node-server/vercel';
 import { cors } from 'hono/cors';
+import { secureHeaders } from 'hono/secure-headers';
 
 /* ------------------------------------------------------------------ */
 /*  Bootstrap (runs once per cold-start)                               */
@@ -38,6 +39,28 @@ async function bootstrapKernel(): Promise<void> {
       }),
     );
 
+    // OWASP-compliant security headers (A05:2021 – Security Misconfiguration)
+    honoApp.use(
+      '/api/v1/*',
+      secureHeaders({
+        contentSecurityPolicy: {
+          defaultSrc: ["'self'"],
+          scriptSrc: ["'self'"],
+          styleSrc: ["'self'", "'unsafe-inline'"],
+          imgSrc: ["'self'", 'data:', 'https:'],
+          connectSrc: ["'self'"],
+          fontSrc: ["'self'"],
+          objectSrc: ["'none'"],
+          frameAncestors: ["'none'"],
+        },
+        crossOriginEmbedderPolicy: false,
+        crossOriginResourcePolicy: 'same-origin',
+        referrerPolicy: 'strict-origin-when-cross-origin',
+        xContentTypeOptions: 'nosniff',
+        xFrameOptions: 'DENY',
+      }),
+    );
+
     // Health-check (always available)
     honoApp.get('/api/v1/health', (c) =>
       c.json({

packages/audit/jest.config.cjs

@@ -4,6 +4,7 @@ module.exports = {
   extensionsToTreatAsEsm: ['.ts'],
   moduleNameMapper: {
     '^(\\.{1,2}/.*)\\.js$': '$1',
+    '^@objectos/permissions$': '<rootDir>/../permissions/dist/index.cjs',
   },
   transform: {
     '^.+\\.ts$': [

packages/audit/package.json

@@ -15,6 +15,7 @@
     "@objectstack/spec": "1.1.0"
   },
   "devDependencies": {
+    "@objectos/permissions": "workspace:^",
     "@types/jest": "^30.0.0",
     "@types/node": "^25.2.0",
     "jest": "^30.2.0",