fix: deduplicate proxied security headers

backend/tests/architecture-tests.js

@@ -78,12 +78,17 @@ test('前端 package.json 与 lock 文件依赖同步且没有手工缓存版本
 test('生产部署统一使用 Vite dist 且不会删除 lock 文件', () => {
   const installer = fs.readFileSync(path.join(projectRoot, 'install.sh'), 'utf8');
   const nginxConfig = fs.readFileSync(path.join(projectRoot, 'nginx', 'nginx.conf'), 'utf8');
+  const nginxExample = fs.readFileSync(path.join(projectRoot, 'nginx', 'nginx.conf.example'), 'utf8');
   assert.ok(installer.includes('npm ci --include=dev'));
   assert.ok(installer.includes('npm run build'));
   assert.ok(installer.includes('frontend/dist'));
   assert.strictEqual(/rm\s+-rf\s+node_modules\s+package-lock\.json/.test(installer), false);
   assert.ok(nginxConfig.includes('root /usr/share/nginx/html;'));
   assert.ok(nginxConfig.includes('alias /runtime/downloads/;'));
+  for (const config of [installer, nginxConfig, nginxExample]) {
+    assert.ok(config.includes('proxy_hide_header X-Request-ID;'));
+    assert.ok(config.includes('proxy_hide_header Content-Security-Policy;'));
+  }
 });
 
 test('Docker 构建上下文排除依赖、环境配置和运行时数据', () => {