improve baseline HTTP security for no-reverse proxy deployment scenarios

[wojcik91]

• added baseline security headers
• HSTS only sent when running with TLS
• added request body size limit
• added request timeout
• enable rate limiter by default
• added Cache-Control: no-store for API routes

Resolves https://github.com/DefGuard/internal/issues/66

[Copilot]

Pull request overview

This PR hardens the proxy’s default HTTP posture for deployments that aren’t protected by a reverse proxy, aligning with internal issue #66 by adding baseline response headers and safer defaults.

Changes:

• Add a global security-headers middleware (incl. conditional HSTS when TLS is active).
• Introduce a global request timeout and request body size limit.
• Harden enrollment/password-reset cookies (HttpOnly, SameSite, scoped Path) and enable rate limiting by default via config defaults.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/http.rs	Adds security headers middleware, request timeout, request body limit, and tracks whether TLS is active.
src/handlers/password_reset.rs	Improves password reset cookie attributes and removes an unwrap() on timestamp conversion.
src/handlers/enrollment.rs	Improves enrollment cookie attributes and removes an unwrap() on timestamp conversion.
src/config.rs	Changes rate-limiter defaults from disabled (0) to enabled (10/s, burst 100).
Cargo.toml	Enables tower-http’s timeout feature to support the new TimeoutLayer.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.