feat(api): add standard security headers middleware (#690)

[ravendevhub]

Summary

Resolves #690 by introducing a security headers middleware for the NotifyChain API server, injecting hardening headers (X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy, and production HSTS) while preserving streaming and CORS capabilities.

Changes

1. Security Headers Middleware (listener/src/middleware/security-headers.ts):
   • Applies X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy, Content-Security-Policy, and Permissions-Policy.
   • Enforces Strict-Transport-Security in production environments.
2. Automated Unit Testing (listener/src/middleware/security-headers.test.ts):
   • Validates header attachment, production HSTS injection, and non-destructive header overrides.
3. Documentation (docs/SECURITY_HEADERS.md):
   • Details header rationale and verification.

Acceptance Criteria

• Security headers are configured intentionally.
• Headers do not interfere with legitimate application behaviour.
• Production and development requirements are documented.
• Automated tests verify important headers.