Scope: headers/cookies/CORS/log redaction/rate-limit review. AC: security checklist passes. Deploy gate: D6.
Scope: headers/cookies/CORS/log redaction/rate-limit review. AC: security checklist passes. Deploy gate: D6.