fix(test): adds Origin header to WAF API tests, reduces parallelism

API paths require Origin header matching the deployment domain per
WAF rule. Adds Origin header for /api/* assertions and a new test
confirming requests without Origin are blocked (403). Reduces
parallel concurrency from j10 to j1 to avoid Cloudflare rate-limit
connection drops.

Author: wgordon17

scripts/waf-smoke-test.sh

@@ -104,7 +104,7 @@ TESTS=(
 # --- Run in parallel (:::  passes array elements directly, avoiding stdin quoting issues) ---
 TOTAL=${#TESTS[@]}
 
-OUTPUT=$(parallel --will-cite -k -j10 --timeout 15 run_spec ::: "${TESTS[@]}") || true
+OUTPUT=$(parallel --will-cite -k -j1 --timeout 15 run_spec ::: "${TESTS[@]}") || true
 
 # Detect infrastructure failure (parallel crashed, no tests ran)
 if [[ -z "$OUTPUT" ]]; then