feat(core-shared): add security headers module with CSP builder and nonce util

Adds framework-agnostic security headers module to core-shared/security:
- SecurityHeadersConfig + CspMode types
- generateNonce() using crypto.randomBytes(16)
- buildSecurityHeaders() emitting all six headers (HSTS, X-Frame-Options,
  X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CSP) with
  prod (strict-dynamic + nonce threading) and dev (unsafe-inline/eval +
  ws/localhost) CSP modes; URL validation throwing InvalidSecurityHeadersConfig
  on malformed allowedConnect/Img/FontOrigins
- Full unit test suite (24 tests, 100% coverage on runtime files)
- Exported from core-shared barrel and ./security subpath

Blocks story 07 (framework adapters) and stories 08-09 (app wiring).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-shared/src/security/nonce.test.ts

@@ -0,0 +1,19 @@
+import { describe, it, expect } from "vitest";
+import { generateNonce } from "@/security/nonce";
+
+describe("generateNonce", () => {
+  it("returns a string", () => {
+    expect(typeof generateNonce()).toBe("string");
+  });
+
+  it("returns base64-encoded 16-byte value", () => {
+    const nonce = generateNonce();
+    expect(Buffer.from(nonce, "base64").length).toBe(16);
+  });
+
+  it("returns different values on successive calls", () => {
+    const n1 = generateNonce();
+    const n2 = generateNonce();
+    expect(n1).not.toBe(n2);
+  });
+});