[ATLURI0001]

Summary of Changes

• Nginx Security Header Inheritance & CSP Hardening (nginx/conf.d/edge.conf):
  • Replaced add_header Content-Type text/plain; inside location = /health with default_type text/plain; — preventing duplicate Content-Type headers and ensuring Nginx continues to inherit server-level security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, CSP, Permissions-Policy) on health responses.
  • Added restrictive Content-Security-Policy and Permissions-Policy security headers on the HTTPS server block.
• Automated Test Coverage (tests/test_project.py):
  • Updated test_security_headers_and_hardening and added test_health_location_preserves_inherited_security_headers to enforce header inheritance invariants.