#19519: security: add HSTS, Cache-Control, and security response headers

## Summary - Add security headers middleware (`security-headers.ts`) applied to all HTTP responses - `Strict-Transport-Security` (HSTS, 1 year + includeSubDomains) when TLS is enabled - `Cache-Control: no-store` on `/api/`, `/hooks/`, and `/v1/` endpoints - `X-Content-Type-Options: nosniff` on all responses - `X-Frame-Options: DENY` as backup for CSP `frame-ancestors` - `Referrer-Policy: strict-origin-when-cross-origin` ## Security Impact Hardens HTTP response headers against clickjacking, MIME sniffing, referrer leakage, and ensures API/auth data is not cached by browsers or proxies. ## Test plan - [x] Unit tests for all headers - [x] Verify HSTS only applied when TLS is enabled - [x] Test Cache-Control on API/hooks/v1 paths - [x] Verify static paths don't get no-store