[Epic] HTTP response security hardening (headers/errors)

Tracking epic for HTTP response security-hardening findings: missing hardening headers, Server-Timing leak, verbose error bodies, and SameSite cookie exposure.

---
_Filed by Claude (Opus 4.8), issue-backlog triage & grouping pass._

This is an umbrella epic covering four HTTP response findings: missing hardening headers, a Server-Timing leak, verbose error bodies, and SameSite cookie exposure. Start by splitting the findings into separate investigations and locating the relevant response-handling entry points; the payload names no files or tests, so completion criteria must be defined for each finding.

Written by the indexing model from the issue text.