security audit v5: project-proxy hardening & middleware consolidation

[mohanadft]

Summary

• P-2 (Medium) — Normalise dot-segments in project-proxy path before prefix check to prevent traversal bypass (/api/method/../../api/auth/admin)
• L-5 (Low) — Replace full header passthrough with explicit allowlist in project-proxy, blocking injection of Cookie, X-Forwarded-For, CF-Connecting-IP, etc.
• M-6 (Medium) — Consolidate dual middleware files: src/middleware.ts (CSP, active) and src/middleware/index.ts (cache-control, dead code) merged into a single sequence(cacheControl, csp) entry point, ensuring cache-control headers are enforced on all routes

Test plan

• Verify GET /api/project-proxy?path=/api/method/../../api/auth/admin returns 403
• Verify normal proxied requests (/api/method/foo) still work
• Confirm Cache-Control: no-store is set on API responses in production (Cloudflare)
• Confirm Cache-Control: public, max-age=600 is set on GET page responses
• Confirm CSP nonce header still present on HTML responses

[cloudflare-workers-and-pages]

Deploying website with    Cloudflare Pages

Latest commit:	942da11
Status:	✅  Deploy successful!
Preview URL:	https://9b4c43de.website-aun.pages.dev
Branch Preview URL:	https://security-audit-v5.website-aun.pages.dev

View logs