Security headers and CSP baseline in next.config

[samjay8]

Context

next.config.mjs currently sets no security headers, so responses ship without CSP, HSTS, X-Content-Type-Options, or frame protections.

Task

Add a headers() export to next.config.mjs with a reasonable baseline: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy, Strict-Transport-Security (testnet: optional), and a CSP that permits the app's own scripts/styles plus the known RPC/Horizon/Supabase hosts. Verify no console or runtime regressions on the main flows.

Stop

Do not ship a CSP so tight it breaks the wallet extensions (Freighter/Lobstr inject scripts) — verify wallet signing still works after the change.

Acceptance

• Response headers are present on all routes (check via curl or devtools).
• Freighter and Lobstr sign transactions without CSP breakage.