A test requests every GET route the router registers and finds Content-Security-Policy, X-Content-Type-Options and Referrer-Policy on each answer, 404s and errors included #5847

The security floor in src/server.ts is held by convention. Today no test walks every route (src/http/router.ts) to prove it.

Done when:

• [ ] The router lists its registered routes, method and pattern, for tests only. No new public route.
• [ ] A test seeds one repository, issue, pull, run and app. It fills each GET pattern's parameters from those, requests every route signed out and signed in, plus one unknown path, and checks all three headers on every answer.
• [ ] A route that needs a parameter the seed cannot supply is listed in the test by name, with why. The list is checked, so a new route cannot slip past.
• [ ] Any route found missing a header is fixed in the same pull.
• [ ] The file runs under 10 s.