fix(security): add security headers middleware (CSP, COOP, Permissions-Policy) — closes #95

[dev-nana27]

Summary

Closes #95 — Hardening: add Helmet-style security headers

Changes

• New file: Backend/src/common/middleware/security-headers.middleware.ts
  • Content-Security-Policy with Leaflet tiles (openstreetmap.org) whitelisted
  • Cross-Origin-Opener-Policy: same-origin
  • Permissions-Policy: disables camera, microphone, geolocation
  • Referrer-Policy: strict-origin-when-cross-origin
  • X-Content-Type-Options: nosniff
• Modified: Backend/src/main.ts
  • Import and register securityHeadersMiddleware after compression, before CORS

FWC26

USDC distribution via Stellar.