feat: add security headers to all responses

[allamiro]

Fixes #279.

Change

Adds DefaultHeaders middleware setting on every response:

• X-Frame-Options: DENY
• X-Content-Type-Options: nosniff
• Referrer-Policy: no-referrer

The middleware is registered last (= outermost in actix's reverse wrap order), which matters: responses short-circuited by the auth middleware would otherwise bypass it — verified during testing.

Content-Security-Policy is deliberately left out for now: embed_in_index injects an inline <script> into the index page, so a meaningful CSP needs frontend changes first (nonce or postMessage approach). Can be tracked separately.

Testing

• cargo test: 9/9 pass
• Live verification with curl: all three headers present on a short-circuited 401 (the case the naive middleware ordering misses)

---

Summary by cubic

Add default security headers to all HTTP responses using actix_web DefaultHeaders. Middleware is registered outermost so short-circuited responses also include them; CSP is deferred due to an inline script in the index.

• New Features
  • Add X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer on every response.
  • Register DefaultHeaders last to cover auth 401s and other short-circuits.

^{Written for commit 4c4b0f2. Summary will update on new commits.}