First deployment

tests/test_security_and_performance.py

@@ -0,0 +1,16 @@
+import time
+
+
+def test_security_headers_present(client):
+    response = client.get("/")
+    assert response.status_code == 200
+    assert response.headers.get("x-content-type-options") == "nosniff"
+    assert "cache-control" in response.headers
+
+
+def test_api_runtime_budget_smoke(client, seeded_news):
+    start = time.monotonic()
+    response = client.get("/api/news?limit=10&language=en")
+    elapsed = time.monotonic() - start
+    assert response.status_code == 200
+    assert elapsed < 0.8