fix(api-server): CORS expose headers + Cache-Control no-store (salvage of #3707/#3712 by @aydnOktay)

[Bartok9]

Summary

Salvages the API-server header portions of #3707 and #3712 by @aydnOktay onto current main.

What the original PRs fixed

• Browser clients could not read Location / X-Request-Id / Idempotency-Key without expose-headers
• Responses lacked a default Cache-Control: no-store from security middleware

Why they needed salvage

Original PRs bundled unrelated skill_commands changes and went stale.

Changes from original

• API server only (no skill_commands drive-bys)
• Unit tests for both header behaviors

Testing

python3 -m pytest tests/gateway/test_api_server.py::TestApiServerCorsAndCacheHeaders -q

Full credit to @aydnOktay.

[teknium1]

Thanks for the focused salvage. Current main's CORS defaults contain only request-side allow headers at gateway/platforms/api_server.py:546-549, and security_headers_middleware has no Cache-Control default at gateway/platforms/api_server.py:698-703. The proposed changes target those live middleware paths, which are installed by the API server at gateway/platforms/api_server.py:4766-4767, and the added tests exercise them through an aiohttp application.

Automated hermes-sweeper review.

[Bartok9]

Rebased onto current main (was ~7k commits behind; mergeable cleaner).

Review note (sweeper keep_open / high): the change remains the same focused salvage of #3707/#3712:

• Access-Control-Expose-Headers includes Location, X-Request-Id, Idempotency-Key on CORS defaults
• security_headers_middleware defaults Cache-Control: no-store when unset
• TestApiServerCorsAndCacheHeaders covers both through the aiohttp app

Local: pytest tests/gateway/test_api_server.py::TestApiServerCorsAndCacheHeaders → 2 passed.

Not merging from author side — ready for re-review when CI is green.

[Bartok9]

Rebuilt onto latest main via patch re-apply (force-push). Please re-run CI.

— Bartok9 public PR hygiene 2026-08-01