Middleware matcher still applies security headers to image/asset routes via negative lookahead on URL suffix only

Opus finding

Middleware matcher still applies security headers to image/asset routes via negative lookahead on URL suffix only

• apps/web/middleware.ts:52-56

The matcher excludes png/svg/ico via suffix patterns but leaves jpg, jpeg, gif, webp, woff/woff2, css, js, and map files in scope. That is probably intentional (the comment says API routes should benefit), but as written the asset-exclusion is inconsistent: an SVG is excluded while a JPG is not, despite both being non-HTML responses where CSP/HSTS provide little value and where misconfiguration (e.g., a CDN re-serving with stale headers) could cause confusion. Minor consistency issue worth flagging.