Add Content-Type response validation in RequestInterceptor

[marcstraube]

Context

RequestInterceptor wraps Fetch but does not validate response Content-Type headers. MIME confusion attacks are currently only preventable via custom middleware.

Goal

Built-in MIME type validation for fetch responses as defense-in-depth measure.

Implementation

1. Add optional expectedContentType to request config
2. Validate response Content-Type header against expected type
3. Throw RequestError on mismatch
4. Default: no validation (backwards compatible)

Files

• src/request/RequestInterceptor.ts
• tests/request/RequestInterceptor.test.ts

Source: AUDIT2 (-2 Defense-in-Depth)