feat: security headers preset (HSTS, X-Frame-Options, CSP, etc.) #54

Context

• Browsers benefit from explicit security headers: Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options / frame-ancestors, optional Content-Security-Policy, Referrer-Policy, Permissions-Policy.
• Today users set headers manually on Response; a preset reduces misconfiguration.
• See Feature gaps.

Direction

• Python helper: e.g. SecurityHeadersConfig → dict[str, str] merged into responses, or middleware that adds headers to all responses (careful with caching / CORS interaction).
• Document HSTS only over HTTPS and staging pitfalls.

Acceptance criteria

• Pytest: response includes expected headers when helper is applied.
• Short docs/security-headers.md or section in handlers.md.

Research

• MDN / OWASP secure headers; duplicate vs override policy with user Response headers.