Fix Missing Security Headers on Netlify

Netlify serves static headers from a top-level _headers file or from TOML configuration. Paths are prefix-based; put global rules first, then route-specific overrides for admin or preview deploys.

Because Netlify sits in front of your build output, headers are consistent across CDN PoPs—similar to Cloudflare but tied to deploy artifacts. Validate with curl against your production URL after each deploy.

HeadersFixer maps missing directives to Netlify syntax so you do not memorize path glob rules.