feat: add Content-Security-Policy header to API responses

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/openjarvis/server/middleware.py

@@ -48,6 +48,7 @@ def create_security_middleware() -> Any:
             response.headers["Permissions-Policy"] = (
                 "camera=(), microphone=(), geolocation=()"
             )
+            response.headers["Content-Security-Policy"] = "default-src 'self'"
             return response
 
     return SecurityHeadersMiddleware
@@ -61,4 +62,5 @@ SECURITY_HEADERS = {
     "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
     "Referrer-Policy": "strict-origin-when-cross-origin",
     "Permissions-Policy": "camera=(), microphone=(), geolocation=()",
+    "Content-Security-Policy": "default-src 'self'",
 }

tests/server/test_middleware.py

@@ -19,6 +19,7 @@ class TestSecurityHeaders:
             "Strict-Transport-Security",
             "Referrer-Policy",
             "Permissions-Policy",
+            "Content-Security-Policy",
         }
         assert set(SECURITY_HEADERS.keys()) == expected_keys