[jdjioe5-cpu]

Summary

This PR resolves #146 by configuring defense-in-depth security headers and Content Security Policy (CSP) in next.config.mjs.

Changes

• Configured HTTP security headers in nextConfig.headers() applied to /:path*:
  • Content-Security-Policy:
    • Restricts default loading to 'self'
    • Supports inline Tailwind and shadcn/ui styling via style-src 'self' 'unsafe-inline'
    • Enables connections to Stellar Horizon and Soroban RPCs (https://*.stellar.org), public testnet/mainnet endpoints, and stellar.expert price feeds
    • Sets object-src 'none', frame-ancestors 'none', and base-uri 'self'
  • X-Content-Type-Options: nosniff: Prevents MIME sniffing
  • X-Frame-Options: DENY: Prevents clickjacking
  • Referrer-Policy: strict-origin-when-cross-origin: Restricts referrer leakage
  • Permissions-Policy: camera=(), microphone=(), geolocation=(): Disables unused browser hardware APIs
• Added automated unit test suite in __tests__/next-config.test.ts to verify the headers configuration and CSP directive coverage.

Testing

• npx vitest run next-config --coverage.enabled=false
  • 3 passed (100% test pass rate)

Closes #146.