[P2] Preserve the pagination and ETag headers advertised to browser clients #55

Recorded during review of main at a1eb305ccfa2f3fc8ddede4875765cf1b099bd2b. This issue records a finding only; no implementation changes were made or requested.

Finding

CORS exposes ETag, X-Total-Count, and X-Next-Page, but the proxy response-header filter preserves only Content-Type, Link, and Retry-After. Browser consumers cannot receive the discarded concurrency/pagination metadata, despite its advertised exposure.

Evidence

• src/proxy.rs:403
• src/main.rs:128
• README.md:203

Desired outcome

Align the forwarding allowlist and browser contract. Add tests that these headers survive forwarding while provider credentials and cookies remain stripped.