A header middleware was tested on a fresh toy app, never on the real one. Delete the one line that mounts it and every test stays green while each response loses its no-index and referrer rules.
Test wiring on the real app. A middleware unit test proves the function, not that anything calls it.
Cover every branch of an allow-list. One untested branch can drop a section from search.
Cover every branch of an allow-list. One untested branch can drop a section from search.