middleware: add security headers to all responses

[0xFelix]

Summary

• Add a SecurityHeaders middleware that sets X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Content-Security-Policy: default-src 'none', and Cache-Control: no-store on every response.
• Wire it into the handler chain in pkg/app/app.go so every endpoint is covered.
• Mirrors the headers already set in the PHP sibling project. HSTS is intentionally omitted - it belongs at the TLS-terminating reverse proxy, not in the app.

Test plan

• make lint
• make test
• make functest