feat(core-shared): add security headers module with CSP builder and nonce util

Adds framework-agnostic security headers module to core-shared/security:
- SecurityHeadersConfig + CspMode types
- generateNonce() using crypto.randomBytes(16)
- buildSecurityHeaders() emitting all six headers (HSTS, X-Frame-Options,
  X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CSP) with
  prod (strict-dynamic + nonce threading) and dev (unsafe-inline/eval +
  ws/localhost) CSP modes; URL validation throwing InvalidSecurityHeadersConfig
  on malformed allowedConnect/Img/FontOrigins
- Full unit test suite (24 tests, 100% coverage on runtime files)
- Exported from core-shared barrel and ./security subpath

Blocks story 07 (framework adapters) and stories 08-09 (app wiring).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

coverage/summary.json

@@ -1,29 +1,29 @@
 {
-  "generatedAt": "2026-05-20T09:21:52.321Z",
-  "commit": "91d7a24",
+  "generatedAt": "2026-05-20T09:32:45.528Z",
+  "commit": "650a97b",
   "repo": {
-    "statements": 97.38,
-    "branches": 92.39,
-    "functions": 97.21,
-    "lines": 97.38,
+    "statements": 97.42,
+    "branches": 92.47,
+    "functions": 97.25,
+    "lines": 97.42,
     "counts": {
-      "lf": 5948,
-      "lh": 5792,
-      "brf": 1196,
-      "brh": 1105,
-      "fnf": 359,
-      "fnh": 349
+      "lf": 6040,
+      "lh": 5884,
+      "brf": 1209,
+      "brh": 1118,
+      "fnf": 364,
+      "fnh": 354
     }
   },
   "byPackage": {
     "@repo/auth": {
-      "statements": 93.81,
+      "statements": 93.83,
       "branches": 92.5,
       "functions": 100,
-      "lines": 93.81,
+      "lines": 93.83,
       "counts": {
-        "lf": 872,
-        "lh": 818,
+        "lf": 875,
+        "lh": 821,
         "brf": 120,
         "brh": 111,
         "fnf": 46,
@@ -101,17 +101,17 @@
       }
     },
     "@repo/core-shared": {
-      "statements": 98.21,
-      "branches": 96.19,
-      "functions": 92.98,
-      "lines": 98.21,
+      "statements": 98.34,
+      "branches": 96.33,
+      "functions": 93.28,
+      "lines": 98.34,
       "counts": {
-        "lf": 1176,
-        "lh": 1155,
-        "brf": 341,
-        "brh": 328,
-        "fnf": 114,
-        "fnh": 106
+        "lf": 1265,
+        "lh": 1244,
+        "brf": 354,
+        "brh": 341,
+        "fnf": 119,
+        "fnh": 111
       }
     },
     "@repo/core-ui": {